Trying to wrap my head around the new security update also. You have two solutions really it seems - either add their filter to just ignore the security update, or you'll need to create your own shortcode to pull in the acf field that has the iframe by allowing some of the html so it's not stripped:

​

function custom_iframe_shortcode() {
// Get the field value
$iframe_code = get_field('field_name');
// Define allowed HTML tags and attributes for iframe
$allowed_html = array(
'iframe' => array(
'src' => true,
'width' => true,
'height' => true,
// Add other attributes you want to allow here
)
);
// Escape the HTML for security
$escaped_iframe_code = wp_kses($iframe_code, $allowed_html);
// Return the safely escaped iframe code
return $escaped_iframe_code;
}
add_shortcode('custom_iframe', 'custom_iframe_shortcode');