What are security vulnerabilities in Angular apps, and how does DomSanitizer prevent XSS?

import { Component, OnInit, inject } from '@angular/core';
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser';

@Component({
  selector: 'app-safe-player',
  standalone: true,
  template: '<iframe [src]="safeUrl" width="560" height="315"></iframe>'
})
export class SafePlayerComponent implements OnInit {
  private sanitizer = inject(DomSanitizer);
  safeUrl!: SafeResourceUrl;

  ngOnInit() {
    const rawVideoId = 'dQw4w9WgXcQ';
    const rawUrl = 'https://www.youtube.com/embed/' + rawVideoId;
    this.safeUrl = this.sanitizer.bypassSecurityTrustResourceUrl(rawUrl);
  }
}