Go to your favorite news outlet's website, find an ad, right click it and choose Inspect. You'll likely see that it was embedded using a cross-domain iframe.

If iframes are so evil and insecure, then why are they still allowed to be used by top websites to let third-party ad networks embed ads?

Please don't ask why I would want to use iframes. I have my reasons for a specific scenario. I know they aren't good for SEO, they are hard to resize, hard to debug, present bookmarking concerns, hard to get to look good, etc.

I'm looking for responses strictly from a security standpoint.

When used properly with the "x-frames-options" and the right "content-security-policy" headers, are cross-domain iFrames still insecure? If so, can you please point me to documented facts?