I have used PBI with Dynamics 365 few years ago before the whole power platform wave. I remember one of the problems was security. I had to pass parameters from CRM to Power BI to filter to the user's data but nothing stopped a more sneaky user to find the iframe url, obtain the PBI url, remove the parameters and view beyond his/her data.
Did security change on that aspect? if not, is there a way to securely embed power bi in Data Driven Apps?