wp_ombed_get() will only process URLs from whitelisted oEmbed providers. The list of supported providers is available here. This means the only code that can be output is embed code from those providers. These are the same providers that WordPress supports for URLs in content, or the embed block in the block editor, so you be reasonably assured that they are safe, as WordPress considers them safe enough for authors and contributors to use.
