This inverts the order from the rest of the system, where the window manager makes the decision on whether or not to forward to the event to the app. This is particularly problematic for cases where, for instance, you have a three-finger swipe to bring up an Exposé-style app overview. Now, if you do a three-finger swipe with two fingers over your browser and one over your keypad, the keypad has swallowed the gesture as regular movement/drag, and you've given the browser a two-finger scroll.
And even all this still doesn't solve any of the security problems. The long and short of it is that if you give untrusted clients complete access to your X server, then you cannot -- cannot -- win in any way.