Sorry for having missed this issue.
It seems it is indeed a change from Pandoc as you guessed. Recent Pandoc version seems to now process iframe tags the same as other when using self-contained document.
You could either use self_contained: false in YAML to not have those data: tansformation, or follow Pandoc documentation and add data-external="1" attributes like this
<iframe src="https://ntu.cloud.panopto.eu/Panopto/Pages/Embed.aspx?id=894e2520-46b3-4c7e-9666-acbc00eee050&autoplay=false&offerviewer=true&showtitle=true&showbrand=false&start=0&interactivity=all" height="405" width="720" style="border: 1px solid #464646;" allowfullscreen="" allow="autoplay" data-external="1"></iframe>
This would prevent the transformation by Pandoc. Source of this info is here: https://pandoc.org/MANUAL.html#option--self-contained
We'll look into that closer to see when this change in Pandoc happened and why.