Hey Rafael, thanks for sorting this stuff out.
The problem with data attributes is that i would have to change the src="" of the iframe to a data-url wich isn't allowed and could possibly have a high security risk.
Also i have no idea why BPS is so aggressive, for example i use iThemes Security and it has no problems with the plugin.
If you can, you should try to disable BPS and see if the thumbs are working correctly or not, ive checked your site and indeed the 500 error has been resolved, however no thumbnail was visible, so it seems its still blocked.