You would have a lot of security issues right? Whether or not it's useful Wayland does prevent to isolate clients from each other.

They’re right on this one, shared memory isn’t some scary dangerous thing. Both processes will just have some region of their respective virtual address space which are mapped to the same physical memory, which they can use to share data. Wayland already uses this for pixel data.

Not really, you can have one command buffer per client or process, and map each one in the virtual space of the process that's supposed to write to it.