Stuff like ydotool, wtype exist and presumably there are others for this. Search on automation testing on Wayland and see.

Since it is a niche I’m not surprised if it wasn’t a critical path for Wayland adoption but clearly there are solutions that work for certain compositors and I assume people working on a more robust solution. But allowing one piece of software to sniff or inject input, or capture its content is an obvious security flaw and Wayland devs are right to put it front and centre. If a desktop is to allow those things then it should be through a security model instead of in the absence of one.