Aha found the issue now:
So what is happening is that when you paste vanila iframe code, then you might bypass onebox code, and if you pass it then the result iframe code will not have data-original-href which is the link that is used in email template.
And when data-original-href is missing discourse tries to guess to the video is that is whatever is after the last / which is of course doesn’t cover the case of unlisted video.
For example if you check the dev tools/inspect element from your browser, the result iframe when using vanfila iframe code:
<iframe src="https://player.vimeo.com/video/508864124?h=fcbbcc92fa" width="640" height="360" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen ></iframe>
<iframe src="https://player.vimeo.com/video/508864124?h=fcbbcc92fa" width="640" height="360" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen=""></iframe>
While when pasting just url, i.e. let discourse convert it to iframe
https://vimeo.com/508864124/fcbbcc92fa.
<iframe class="vimeo-onebox" src="https://player.vimeo.com/video/508864124?h=fcbbcc92fa&app_id=122963" data-original-href="https://vimeo.com/508864124/fcbbcc92fa" frameborder="0" allowfullscreen="" seamless="seamless" sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-presentation"></iframe>
So notice the extra data-original-href="https://vimeo.com/508864124/fcbbcc92fa" in the second output, one might guess if that attribute when using iframe vanilla then it should work, but it doesn’t probably because discourse doesn’t allow you to add any attriubte you want…