A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
Dear James,
Yes, you are right.
Based on my test, custom script needs to be enabled for the Embed web part with HTML code. The administrator can enable it every 24 hours via SharePoint Online Management Shell. Set-SPOSite https://contoso.sharepoint.com/sites/sitename -DenyAddAndCustomizePages 0
The SPFX solution is the alternative way of the custom script. It runs within the SharePoint Framework and doesn't rely on the custom script settings for its execution.
@Webbrewers, there may be no specific article about that currently. Similarly, you can see the detailed information about the SPFX part in Security considerations of allowing custom script - SharePoint in Microsoft 365 | Microsoft Learn.
Thank you for your time and effort.
Sincerely
Cliff | Microsoft Community Moderator