The max oneboxes per post setting controls the number of oneboxes that can be added to a post. The terminology could be confusing here, but a “onebox” is the way that Discourse handles links from a variety of sources. For example, if the link from the browser’s address bar for a Youtube or Vimeo video is added to a line of its own in a post, Discourse will generate a onebox video player for the link.
If you set max oneboxes per post to 0, users will not be able to create these types of oneboxes.
I think what you are finding is that the setting does not prevent users from adding iframe elements to posts. To prevent users from adding iframes to posts, remove any of the iframe sources that are listed in your site’s allowed iframes site setting. Here are that setting’s default values:
