It isn't XFCE specific bug, it can occur in KDE too. If you run `xhost +; steam`, the program starts (but this is unsecure!).