Is Twitter allowing arbitrary code execution on their platform?

I'm pretty certain its running in an iframe

Apart from how cool it looks, isn't this a huge safety concern?

No, frames predate the modern internet. Actually, one of the very first CVEs was related to XSS and birthed cross-origin policies.

Pretty much every exploit related to embedding third party code in a frame has long been closed.

Seems to be normal from mobile - that game opens in new tab

For me, using Opera on Android 12 it opens within the tweet, not a separate tab