Yes, it does. But that iframe is dynamically invoked by JavaScript executing in the parent page. The user can't easily see that the popup is more secure than the background page.