Firejail uses nested X11 servers like xeohyr or xrdp to restrict application access to the primary X11.

Hmm, I thought it was Xephyr but I was wrong. It looks like Qubes actually does something even more involved:

https://doc.qubes-os.org/en/latest/developer/system/gui.html

This makes sense though, given the way clipboard works in Qubes. I think I must've entirely mistaken how Qubes works for an entirely different scheme.