>Obviously, XZ happened on Debian. But $malware can occur on any Linux distribution at any time. For a recent example just look at Arch Linux.
? Debian has a track record and a reputation. And Arch Linux has another, much worse, track record and reputation. You argue that it can happen to any distribution, yet it happens to one and not the other on a continuous basis, maybe it's not luck and maybe it has something to do with design and quality, quite possibly with the fact that packages are vetted and tested thoroughly before releases instead of being pushed as soon as they are available without much review.
>Also, are we still assuming that we would still get only one attack over 20 years, instead of the frequency increasing to, say, one attack per year?
If you want to make a wild bet, go to the casino. The probabilities given the current data is that there's roughly 1 malicious package over 20 years (I'm rounding up and counting the almost as a vulnerability).
>My original point is that: why should we not practice defense-in-depth, where we make sure malwares have to jump through multiple hoops (and hope that they trip on one of them!) in order to launch an attack?
I'm not convinced this is true at all. First of all you can run X servers under different users and as such isolate applications per user. As mentioned by other users, Xephyr makes nesting possible so as to not depend on root.
Thirdly, to the extent that it is possible to introduce a vulnerability through manipulating an X window, it will be possible to do so via other means like filesystem manipulation. That is, it's a system design tradeoff that if you run a malicious process as a user, the rest of your processes are almost guaranteed to be vulnerable.
Fourthly. Virtualization isn't a magic invokation that provides security on demand. You need to learn how the stuff works. For example, in the clusterfuck of container configuration, there's an Xauthority being shared that essentially undoes the whole containerization.
Virtualization is like a 5 inch thick wall, which sounds alluring to people that don't know what's on the other side of the perimeter, but it turns out that in order to do something useful, you need doors, and a house with 5 inch thick walls and a door without a key, is just as unsafe as a house with regular brick walls and a door without a key.
Virtualization is an antipattern, a patch to be applied under considerable stress, a glass to be broken in case of emergency, a move you pull when an engineering has been fired long ago and you don't want to learn about their system, a move you pull if you are in a big org where the role of the one who writes code and the one who runs commands on a system are separated by 5 more layers of roles, a hat on a skyscraper where we want to add the final few meters with pyramidal engineering, hoping that nobody asks us to add another floor.
Don't virtualize if you can avoid it.