The SecureHeaders middleware has the following default value:

$response->headers->set('X-Frame-Options', 'DENY');

This causes an issue when using the DAM package to preview documents in the iframe: