This happens anywhere FCKEditor is shown. Currently I have seen it in Text/HTML and News Articles Module. Interestingly, if I switch to text only in a TEXT/HTML editor, I can insert the flash embed code and it gets saved and displayed correclty. However, when you go back to edit it, it switches back to FCKEditor by default and that clears the source component of the flash embed. So the problem is definitly around fckeditor and its interaction with DNN. As you suspected must be around security (I think). But where to check it is something I dont know.
I had a look at fckconfig.js and the only flash related stuff I can see are these, which are not inspiring.
FCKConfig.FlashDlgHideAdvanced = false ;
FCKConfig.FlashBrowser = true ;
FCKConfig.FlashBrowserURL = FCKConfig.BasePath + 'filemanager/browser/default/browser.html?Type=Flash&Connector=connectors/asp/connector.asp' ;
FCKConfig.FlashBrowserWindowWidth = FCKConfig.ScreenWidth * 0.7 ; //70% ;
FCKConfig.FlashBrowserWindowHeight = FCKConfig.ScreenHeight * 0.7 ; //70% ;
FCKConfig.FlashUpload = false ;
FCKConfig.FlashUploadURL = FCKConfig.BasePath + 'filemanager/upload/asp/upload.asp?Type=Flash' ;
FCKConfig.FlashUploadAllowedExtensions = ".(swf|fla)$" ; // empty for all
FCKConfig.FlashUploadDeniedExtensions = "" ;