If you read their security statements, they block JS and cookie access and do not arbitrarily allow just any code.
Selectively allowing some services is what they do. Vimeo and Soundcloud are in the list.
The open source projects provide exactly what you asked for...
Try looking at the links.
The issue I see is that it opens the gates too wide, and hands the keys over to someone else.
There, you found one I can agree with.
Good thing it is open source so they can just take the good parts...