I had a brief chat with user KindShaman about iframe tags and security. Of course, it was pointed out to me that the forum doesn't fear this tag for no reason and that various nasty things can be done through it. However, loading any arbitrary third-party iframe onto forum pages is not necessary for this task; it is sufficient to check via a mask that the frame is specifically a YouTube video. Since the service generates the embed code itself, it is extremely predictable and easily fits within the framework of a regular expression something like this:

(I tested it with the code higher up on the page, and it worked)
(if you copy this code, it's better to take it from the message "code," because it is displayed slightly differently on the forum page).
In other words, everything is strict — one step left or right and you're shot. Nothing foreign will get through. But I am, of course, not aware of the implementation details; simply if security needs to be combined with new YouTube videos, I would suggest something like this.