I want to install X on a system I'm in charge of. I plan on running it with local connections only, e.g. with
startx -- -nolisten tcp (which I understand is the default these days).
Some relatively old notes on security, Crash Course in X Windows Security, imply that displays are inherently insecure:
Running your display with access control enabled by using 'xhost -' will guard you from XOpenDisplay attempts through port number 6000. But there is one way an eavesdropper can bypass this protection. If he can log into your host, he can connect to the display of the localhost. ... Of course, an intruder must have an account on your system and be able to log into the host where the specific X server runs. On sites with a lot of X terminals, this means that no X display is safe from those with access. If you can run a process on a host, you can connect to (any of) its X displays.
The implication here is that there's no way to provide even elementary security for X displays locally.
Is that true? If not, are there configuration settings one needs to consider that can prevent it?