Don’t remember exactly when (4.3?) core had gone with a much more restrictive parsing of shortcodes due to many security problems that the lax parsing with combination of poorly implemented shortcodes had created. The end result is that you can not use a shortcode in an attribute.
The right solution is to have a shortcode that produces the whole iframe. Partial kinds of shortcodes are never a great idea as in most cases, they are not easy to understand and too easy to break with some accidental input.