my understanding is that svg in <img> is safe but prevents script execution

svg in iframe + srcdoc + sandbox gives you sortof-inline svg with separate security contexts.

only plain inlined svg should be a security risk.