By that logic, is the compositor working any different than a trojan? Is there really a difference?

The Wayland compositor is always capturing all your keyboard and mouse as well. No permissions asked. Pretty sus.