A more permissive child-src should not relax restrictions from a less- permissive frame-src. Directives still combine for least privilege, even when one obsoletes another.