I suspect that this is a bug. I tested this on my test site in 2.0.9 with "Allow Embedded Media" set to No. I analyzed my permissions and overall came out at No too. I then added a YouTube URL, saved and had an embedded video in my signature.
Checked on here too and as you can see, a video embedded in my signature, which I don't believe is allowed here.