With sudo you can set per user and per program policies about wether to retain or reset the callers environment in the context of sudo. The env_reset policy is set by default.
You can't run graphical applications via pkexec without explicitly configuring it to do so. Because this is merely a result of the environment reset this is obviously true for sudo as well. Note however thet neither pkexec nor sudo can prevent a malevolent application running as root to retrieve all neccessary information from the display managers or the users X11-cookie file. The latter, both or similiar, may even be done by non root applications depending on circumstances.
Sudo does not require explicit listings of users. Listing any user group or even setting a permission for all users in general can be done. The target_pw directive allows those users to authenticate with the credentials of the user in whoose context they want to run an application, i.e. root. Apart from that the equally traditional su (su / gtksu / kdesu) program can be used to do the very same without special configuration.
sudo, too, allows the user to remain authenticated for a specified time. The option is named timeout, configurable globally, per user, or per application. Authentication can be retained per tty or globally per user.
While pkexec may do no validation of the ARGUMENTS passed to PROGRAM, sudo does indeed have this feature. Admitted though, you can easily mess up with this, and it is normally not done.
You can tweak a little how you want programs to be run via pkexec: icon, text to display, you can even have localization stuff and all that. Depending on circumstances this can be nifty indeed. Sad though, that someone felt the need to reinvent the wheel for this feature. This would probably be something to put into the graphical gtksudo/kdesu wrappers.
Policykit is only a centralized configuration framework then. Unfortunately not a pretty one. PKs XML-Files are way more complicated than anything an app could provide natively short of binary files. And no one would be so looney to use binary ... oh gconf ... never mind.