An ancient kernel hole is closed

Probably because of legacy drivers which do not use kernel modesetting, or to be able to use X with kernel modesetting disabled (for the drivers which can run either with or without kernel modesetting).

I wonder which restrictions xserver_t has on selinux. If it is restricted enough, it is possible that, even if you can inject code on Xorg running as root, you cannot do much without having to first do DMA tricks to break out of it.

It might be an interesting exercise to make Xorg drop even more permissions (by changing for instance to a xserver_kms_t which cannot touch the hardware) when kernel modesetting is enabled (while keeping the ability to run without kernel modesetting by simply not dropping the extra permissions).