On: Xorg-server 26.1.0 rc1

[M95D]

You don't need sudo for trace under the same account. You can even attach a debugger and read all app's memory.

Virtualization is another thing entirely. But if you want it that way, then why not simply start a second X for the untrusted app?