I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, with the iframe pointing to the malicious payload.
Given this, together with the fact that I have really seen almost no legitimate iframe applications that aren't obnoxious, why are they allowed at all in modern browsers? It seems to me that a easy way to block a significant number of the drive-by attacks would be to simply disable iframe support in the browser.
Alternatively, a "click-to-load" mechanism, similar to the "click-to-flash" plugins common for many browsers would have a similar effect, without completely preventing existing sites that use iframes from working.
Alternatively, disallowing iframes that load content from another domain would probably be effective too.
I certainly don't claim that blocking iframes would solve every web-security solution, but from a cost-benefit perspective, it seems a very easy way to blok a significant number of security issues.