How so?

You fool a valid sender into thinking you're the recipient, he passes you his one and done key, which you use to login and takeover.

You're only passing public keys with WireGuard, its asymmetric not symmetric encryption.

It doesn't matter if an attacker gets your (or the server's) public key.