The issue is related to the “Data Consent Form” and OneBox catches that instead of the actual content.
If instead of using the https://youtube.com/watch?v=XYZ you change it to https://youtu.be/XYZ it works because that’s the “Share URL” and that doesn’t pop the Consent Dialog. (However, this is not ideal).
Unless Discourse/OneBox “autochanges” the URL to the “Short Version” when oneboxing, maybe, as a quick fix? IDK, just giving more info/feedback.