When X11 forwarding is enabled, there may be additional exposure to the server and to client
displays if the sshd(8) proxy display is configured to listen on the wildcard address (see
X11UseLocalhost below), though this is not the default. Additionally, the authentication
spoofing and authentication data verification and substitution occur on the client side. The
security risk of using X11 forwarding is that the client’s X11 display server may be exposed to
attack when the SSH client requests forwarding (see the warnings for ForwardX11 in
ssh_config(5)). A system administrator may have a stance in which they want to protect clients
that may expose themselves to attack by unwittingly requesting X11 forwarding, which can war-rant warrant
rant a “no” setting.

Note that disabling X11 forwarding does not prevent users from forwarding X11 traffic, as users
can always install their own forwarders. X11 forwarding is automatically disabled if UseLogin
is enabled.

X11UseLocalhost
Specifies whether sshd(8) should bind the X11 forwarding server to the loopback address or to
the wildcard address. By default, sshd binds the forwarding server to the loopback address and
sets the hostname part of the DISPLAY environment variable to “localhost”. This prevents
remote hosts from connecting to the proxy display. However, some older X11 clients may not
function with this configuration. X11UseLocalhost may be set to “no” to specify that the
forwarding server should be bound to the wildcard address. The argument must be “yes” or
“no”. The default is “yes”.
Reference: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man5/sshd_config.5.html

UsePrivilegeSeparation
Specifies whether sshd(8) separates privileges by creating an unprivileged child process to
deal with incoming network traffic. After successful authentication, another process will be
created that has the privilege of the authenticated user. The goal of privilege separation is
to prevent privilege escalation by containing any corruption within the unprivileged processes.
If UsePrivilegeSeparation is set to “sandbox” then the pre-authentication unprivileged
process is subject to additional restrictions. The default is “sandbox”.
Reference: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man5/sshd_config.5.html