This thread seems to suggest that onebox can render unlisted videos but I may be misunderstanding something there.
The video still displays in a browser logged out or using incognito mode.
Regarding Vimeo, I pasted the wrong image. This below is what I see in preview when pasting in the Vimeo link for a post:
1 Like