SECURITY extension (X11)
X11's belated attempt to separate trusted clients from untrusted ones, and the reason ssh -X and ssh -Y are not the same thing.
In the core protocol every client on a display is equal: anyone can read any window, listen to the keyboard or send fake keystrokes to another program. The extension arrived with X11R6.3 in 1996, as part of the Broadway project meant to run X programs from the web, and introduced two classes. An untrusted client connects with a special xauth cookie and is then refused permission to read other windows' contents, snoop on their properties, perform grabs or use most other extensions.
OpenSSH made untrusted mode the default for -X in 2004 and added -Y for anyone who wanted the old behaviour. The trouble was that a great many programs assumed full access and crashed with BadAccess rather than adapting, so Debian and several other distributions put ForwardX11Trusted yes in their default configuration and made the difference between the flags cosmetic. Real isolation between programs had to wait for Wayland, which built it in from the start.