Hexbear.net stays winning, external embeds are domain whitelist-only until pictrs adds proxying support, and blurred by default.
Good PSA tho, I'd honestly encourage other instances to do the same but it requires dev effort that I know not everyone has, and upstream isn't quite as paranoid about this stuff.
as far as I know upstream lemmy doesn't want it and is waiting on pictrs proxying support. If I'm wrong though our code is public, I'm sure a dev would be happy to put together a PR,