Alternative interpretation: Iframes are so overpowered and such an edge case for the browser's security models that they cause constant issues with the rest of the reasonable browser spec.
But we need a way to tell a browser "if you embed this page into an iframe, it needs to be the topmost content, no transform/translate/visibility or anything". Social/login iframe would set that flag, and it would prevent the clickjacks and attacks like this.
Still no up-front browser setting for disabling them. I wonder why...