Correct, this component will not mess with any whitelisting settings at all.
In order for any iframe to show up in the cooked content of a post - expandable or not - it has to be on the list of allowed_iframes setting like you pointed out.
I’ll add a note about this to the topic.