Hi there!
There is a core ticket about this:
https://core.trac.wordpress.org/ticket/34737
There is a standard that core does follow as well:
https://make.wordpress.org/core/handbook/contribute/design-decisions/#whitelisting-oembed-providers
- be be well-established, popular, and mainstream services
- properly and fully implement the oEmbed specification
- clearly be a trusted provider