Your editors are trusted. Sanitise anyway.
A tag allow-list cannot say an iframe must point at YouTube. The attribute filter that can, and the wrapper span that quietly bypassed it.
CORS for a write surface
Allow-Origin star is fine for a public feed and catastrophic for a write endpoint. A per-form allow-list, exact origin matching, and the preflight trap.