Yes. We use <iframe>s with the sandbox attribute (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...) to uh ... sandbox away the running JavaScript.

If you inspect them, you'll see that those frames are hosted on observableusercontent.com instead of observablehq.com.

It's a similar security model to how raw files on GitHub are served from githubusercontent.com.