The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security scripts like frame busters, killers & etc.
For example, here are three pages:
This page contains a very poor frame buster, but good enough for this demonstration. In case the page is not the top frame in his window it redirects the window to the page location.
<html> <body> <center><iframe src="noIFrame.htm" border=1> </center> </body> </html>
This page contains an example, what happens when the attacker just add the page using iframe, without enabling the security attribute on. The result of opening this page is a quick glance at the click jackers page and then the browser redirection to the page location.
<html> <body> <center><iframe src="noIFrame.htm" security="restricted" border=1></center> </body> </html>
Finally, this page demonstrates implementing the security attribute. The iFrame is loaded, and since the attribute is set to restricted the frame busting script is not redirecting the browser to the victims page location. Note this attack is viable only in IE8 and above.
Now assuming a malicious user can upload files to the victims web server*, (disabling by my understanding the possible use of X-Frame-Options) how can the victim protect his website from click jacking attacks against his IE users?
*This is an hypothetical question, of course if attacker has access to the web server domain he would attack differently.