They convert it into an embed yes, the first solution would be on discord, but isn’t the second on twitch’s end?
They use a sandboxed iframe within the embed just the way any other site would, except using parent=meta.tag instead of parent=sitename.com Given the CSP returned by using meta.tag it looks like it is generated by Twitch.