interestingly, this is because of mobile apps. I used the share function in the youtube app, coupled with the "copy link" intent on android that pops up. This is the link that was given to me and i pasted it here.
On a mobile device using a native app, it is quite hard/impossible to get a different url. Could you whitelist the youtu.be url ? because I'm guessing this will start to happen more frequently.
Part of the reason Youtube provides the youtu.be link is that their systems disambiguate between mobile and desktop websites.
Mobile versions have the 'm.' subdomain, and provide a less optimized experience for desktop.
I would also argue that the youtu.be link is a canonical form, since the identifiers are identical to the source. It is just an optimized canonical proxy.
On a mobile device using a native app, it is quite hard/impossible to get a different url. Could you whitelist the youtu.be url ? because I'm guessing this will start to happen more frequently.