Yes. Open-source code is meaningless in context of web apps, be it loading in iframes or anywhere else. It's never anything more than "I promise that this is the code that is loading there at this time".