By default, X11 lets you see all the windows, and input events. Theres even a command line app for viewing all this. There were some attempts at restricting this over the years. Probably the best known was the optional limited x server access over ssh. X11 over networks could require authorization, and most unixes and linux distributions did this by default. But that gave the process all the authorization for that display. One workaround I, and some of my friends, used was nested X servers or other remote display protocols for certain tasks.
This is all part of the desktop model of operating systems where the OS gives all apps of a user, all permissions of that user. Recently, like in the last 10 or so years, this slowly started changing. But not like mobile operating systems which already stopped this nonsense by design.
One of the design goals of wayland was to fix these security issues. I'm happy to leave X11 behind.