I agree with the recomendation of removing the setuid bit and using xdm to start the Xserver, and if you have XFree86 on a machine where this problem is significant, you should consider doing this. The fix is to disable the '-config' Xserver option. This will be removed in our next release, and also in the next X11 release from The Open Group. It was only added to get around problems on OS's with small command line length limits, and should never have been enabled for most Unix-like OSs. The problem isn't XFree86-specific.
Any user can read files with root permissions.