Where does “rel=0” get removed from my YouTube parameters?

Iframe content is generated by youtube itself, wordpress just requests it via oembed call. If you wish you can study wp-includes/class-oembed.php code, but that will not help you to change iframe parameters. For that you may apply embed_oembed_html filter, see https://developer.wordpress.org/reference/hooks/embed_oembed_html/. It receives iframe html code, so you can do some string replacements to change it.