Thanks
It appears to be exactly as I expected: They've defined a special "[youtube]" tag containing just the YouTube ID, which would then be turned into HTML to display a YouTube video. This makes it safe, since the HTML to embed a (sometimes dangerous) object can't be abused to embed something other than a YouTube video.
OK, that's how I'll do it when I take another run at the software.