Kind of, in that embedding anything from a site you can’t trust is inherently risky, but I’d say it’s not actually that bad, for two reasons:
iframes are much better sandboxed than they once were, and are much safer now than their reputation suggests
you probably wouldn’t be embedding from any old instance; I assume you could embed from an instance you use and trust as long as the post is federated to it
But isn’t that inherintly dangerous? I don’t exactly trust any random fedi server to embed it in my website.
Kind of, in that embedding anything from a site you can’t trust is inherently risky, but I’d say it’s not actually that bad, for two reasons: