Vite Web Worker plugin fails in resctricted environments (iframe)

[demike]

Describe the bug

when creating an inline worker like:

import SVGOWorker from './svgo.worker?worker&inline';

something like the following snippet is inserted into the resulting file

base64string
...
           const blob = typeof window !== "undefined" && window.Blob && new Blob([atob(encodedJs)], { type: "text/javascript;charset=utf-8" });
            function WorkerWrapper() {
              const objURL = blob && (window.URL || window.webkitURL).createObjectURL(blob);
              try {
                return objURL ? new Worker(objURL) : new Worker("data:application/javascript;base64," + encodedJs,{type: "module"});
              } finally {
                objURL && (window.URL || window.webkitURL).revokeObjectURL(objURL);
              }
            }

This fails with Not allowed to load local resource: blob:null/f1883bd0-1f7f-4bbc-8482-d54d540cacf7

if I change the snippet to

...
            function WorkerWrapper() {
                new Worker("data:application/javascript;base64," + encodedJs,{type: "module"});
            }

everything works.
Seams the Blob variant is not allowed here. But base64 data url variant is allowed

Removing the blob variant works.

Reproduction

---

Steps to reproduce

Can be tested i.e in a figma plugin
https://github.com/figma/plugin-samples/tree/master/esbuild-react
(a plugin example using vite (with esbuild)

System Info

System:
    OS: Windows 10 10.0.19044
    CPU: (16) x64 11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz
    Memory: 34.42 GB / 63.73 GB
  Binaries:
    Node: 18.12.0 - C:\Program Files\nodejs\node.EXE
    Yarn: 1.22.19 - C:\Program Files\nodejs\yarn.CMD
    npm: 9.2.0 - C:\Program Files\nodejs\npm.CMD
  Browsers:
    Edge: Spartan (44.19041.1266.0), Chromium (109.0.1518.70)
    Internet Explorer: 11.0.19041.1566
  npmPackages:
    @vitejs/plugin-react: ^3.1.0 => 3.1.0
    vite: ^4.1.1 => 4.1.1

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[fi3ework]

similar to #11956

[fi3ework]

@demike Could you provide a more detailed re-production step to help address this issue? I failed to run the Figma demo above.

[sapphi-red]

I'm not sure what is blocking blob in this case, but using a CSP header failed similarly.
https://stackblitz.com/edit/vitejs-vite-gr1h2i?file=main.js