do_action(), iFrame Gets Displayed Despite Password Protection [closed]

do_action does not return text, it just does the action. So, calling do_action( 'tribe_events_single_event_after_the_meta' ) in your do_shortcode call there will cause the iframe to be output before the shortcode.