That only determines who/what can connect to the X server at all, it's either a host/user/client with a cookie can connect to the X server or it can't at all; that has no bearing on me wanting to be able to use graphical applications that are able to connect to the display server without having each one of the graphical applications so connected to be able to read all my keystrokes and the output of my entire screen.