To add to this, there's also a slow transition towards safe frames [1] that allows for better protection than friendly frames by restricting all page-iframe communication to a specific API.

[1] https://www.iab.com/guidelines/safeframe/