The security risk is precisely why a lot of new services provide embeddable content via iframes now, rather than JS. On the other hand, this still isn't perfect - we wrote about it today, actually: https://www.tinfoilsecurity.com/blog/protect-your-website-fr...
Iframes do suck. However, success of a whole crop of companies like Disqus depends on it sucking less. I am sure this is a known issue for these companies.
