It’s weird looking back on support requests from before I joined the team 
What I said above is still true. You need to explicitly specify a height for the iframe in the oembed json. You now also need to add the iframe domain to the whitelist in site settings (In March 2017 this was not required). In summary, onebox doesn’t really support the “rich oembed” specification too well.
Even in the spec, they have security concerns
Consumers may wish to load the HTML in an off-domain iframe to avoid XSS vulnerabilities.
Given the lack of sites actually using rich oembed, I think it’s fine to leave things as-is.