In GM, when a user script has @grant none, either by explicitly specifying this in the header or when the horrible grant sniffing doesn't find any special API in the code or comments(!), then the behavior of the sandbox changes: The sandbox will be created with wantXRays: false, causing window to be unwrapped, so that window === unsafeWindow.
window === unsafeWindow
IMO, this is completely confusing, especially because of the grant-sniffing, and a compatibility nightmare.
Since they wontfixed greasemonkey/greasemonkey#1801, this behavior is there to stay. For more details, see that issue.
To avoid further compatibility issues between scripts written with GM but installed in Scriptish, we might want to consider mirroring their behavior.
I'd rather not make the change that GM did, and keep wantXRays: true for now. @nmaier do you concur?