I don't think your Wayland comparison is great. There are already solutions to app isolation that make X a weak link, e.g. Android or Qubes. Whereas there's basically no future where SHA1 in Git is the weakest link.

Also security was only one reason for Wayland.