There is a very specific use case where it would have to be inside an iFrame. I am unable to add an iFrame with the source set to another Webstudio website.
I actually was working on setting up a worker to add a password to the website and then display it within an iFrame when I ran into this - Here is the code: https://jsfiddle.net/7s4zt2hb/
Yeah, so you would need the worker in any case, all you need is to set the content-security-policy header, currently its "frame-ancestors 'self'" - which means no emebeddings, but you can either enable embeddings for all sites or define the specific parent url