it's about complexity. currently: the x11 proxy listens listen to inaddr-any. nice to have: listen to localhost or inaddr-any. other options: too much complexity/code/bugs in openssh. ideally openssh, especially the sshd should have no option.