The author(s) got in contact with me about this post: it does appear that the APIs are exposed at the window level, meaning any iframe can access these functions. It's important to note that CSP does not traverse iframes, or at least, has very strict rules about how it does due to an information leak in CSP1 [1]. This means embedded content is not going to be affected by any CSP rules. OEMBED content, or sandboxed rendered markdown is going to be served from the `null` origin, meaning that frame-src rules will have no granularity.

[1]: http://archive.is/UXD8j