Thanks for taking a look! I’m fairly certain there have been no changes; I did take a look at that setting and it simply had the default value (“*”). I just tried removing that wildcard and replacing it with a single domain (YouTube) but it doesn’t seem to have had any effect on the embed.
That pxtoembed class and iframe that you screenshotted come from the oembed endpoint that we link in the embedded page:
However that’s been there for years, I’m not sure why it suddenly started getting embedded today.