Does Is there a desktop Carlisle of being secure enough for OpenBSD? Last time I installed it X and window managers were in ports and therefore didn't get the same kind of scrutiny as the rest of the OS. If you're wrecking security by installing an insecure GUI you may as well run Linux.
X gets some scrutiny - it now runs with no user-to-hardware access on lots of hardware, and with restricted user-to-hardware access on most everything (for more information, look at machdep.allowaperture.)
Window managers aren't common sources of vulnerabilities, but there are two in base (an older fvwm, and cwm [EDIT: and twm]).
The real problem, of course, is that you probably want a browser. Even with OpenBSD's hardening and secure defaults (-current takes some steps towards not hooking up gstreamer-plugins[-good] to the internet), browsers are plenty scary.
