WebXDC threat model?

Yes, it’s not possible generally. The “location sharing” feature is indeed based on WebXDC, but it is a special case. Normal WebXDC apps don’t have access to the geolocation API.
See Allow access to camera, geolocation, other Web APIs - #4 by WofWca.