It is likely that your desktop Linux distro, or whatever, is configured out-of-box to run the X server that only listens on the unix:0 domain.

You can reconfigure it, restart it, or start a secondary server. And check your firewall/packet filtering setup while you're at it.

There are several cryptographic security methods for the xauth(1) system.

https://manpages.ubuntu.com/manpages/resolute/man7/Xsecurity...

Notably, "si" or "server interpreted" is not cryptographically secure. However, you can share MIT-MAGIC-COOKIE values easily by copy-paste into another user's xauth command.