I've often wondered how easy it would be for people in the scene to rip Netflix or others streaming content. Isn't it as simple as getting the URL of the video player element in the browser and using cURL or wget?
It is, but the resulting files are encrypted. Hence this post being about exposing CDMs (Content Decryption Modules). These use decryption keys obtained through hacking or paying internal staff. Once the decryption keys are exposed like this then the content providers 'burn'; them and generate new ones meaning the process has to start over again.
I assume at some point Widevine plugin decrypts these files to display the actual video stream in the browser, correct? Why don't they capture already decrypted stream?
That's why they now embed displays with verification modules. Basically whole stack from server to your display is a giant chain verifying you are not doing what they don't want you to do.
And see how well it works. 2 hours after airing everything is online. The only ones they're giving any hassle are legitimate consumers.