@cel7t >I'm aware that it's not a good idea from a security standpoint.
How so? A login manager has a much greater attack surface than fbcon+getty+login.

A secure way to start wewlad is; if [[ -z $DISPLAY ]] && [[ $(tty) = /dev/tty1 ]]; then exec dbus-run-session sway; fi

Due to the 'exec', if wayland crashes or is terminated, the session will logout.