Which block or blocks? What reports confirm this? I only heard about some possible URL embeds that pointed to malicious data, very different from direct malicious media data embeds.

this issue is infuriatily tedious if we pretend there is no difference between a builder signing their name on a joist when framing your house, and the building signing the front door.