Ckeditor 4.21 blocking iframe

A possible solution is to add needed config described here: https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-... via hook_wysiwyg_editor_settings_alter()

/**
* Implements hook_wysiwyg_editor_settings_alter().
*/
function hook_wysiwyg_editor_settings_alter(&$settings, $context): void {
if ($context['profile']->editor == 'ckeditor') {
$settings['iframe_attributes'] = [
'sandbox' => 'allow-scripts allow-same-origin',
'allow' => 'autoplay',
];
}
}

I don't want to close this topic, however, I am not comfortable with moving forward with an update with this module if it approves 4.21. Frankly, without something addressing the issue, I would say that 4.21 is not recommended for use with WYSIWYG. This puts everything into a conundrum, of course, because it is a security patch. Any thoughts?

Regarding #3, it goes into a discussion as to whether or not it's a good idea to allow allow-scripts and allow-same-origin at the same time. See, https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe, for more detail. The issue is,

When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both allow-scripts and allow-same-origin, as that lets the embedded document remove the sandbox attribute — making it no more secure than not using the sandbox attribute at all.
Sandboxing is useless if the attacker can display content outside a sandboxed iframe — such as if the viewer opens the frame in a new tab. Such content should be also served from a separate origin to limit potential damage.