>> I totally agree with you that normal applications should be able to go full screen,
> I don't. At least not without some kind of overlay.
It depends on the situation.. On your home PC, is-it really an issue?
To fool you into entering your password, the trojan must be able to replicate somehow your environment, which is quite difficult if it isn't allowed to generate input events (like Wayland does).
Where security is important, I think that it should be possible by administrators to disable full screen windows.