Piracy is inevitable, but in this case their model is much more robust that I would have predicted.
So basically they have this very secure scheme for getting movies to theaters, but everything else is full of holes. Makes you wonder if all the effort and cost to secure the theater distribution chain is worth it. If you're going to allow playback on devices in "adversarial" hands (streaming, home physical media playback), it's going to be incredibly difficult to restrict copying. Tightening up the one instance where the hardware and people operating it have less incentive to pirate (and more incentive to not pirate, given the risk to their theater business) seems like wasted effort.
Certainly this does make the case of a theater-only-first release nearly impossible to pirate. But there aren't quite as many of those anymore, and all this DRM must be expensive, both in the hardware/software, and in the logistics. I guess they've found it's worth it, but... oof.
Kaleidescape movie players[1][2] are an example of an "adversarial" environment in customers' homes but so far, their DRM is still unbroken by pirates. (10+ years of Strato players deployed out in the wild but still not defeated yet.)
The 4k 100+ GB encrypted files downloaded by Kaleidescape is considered 1 step below the DCP theater releases and are higher quality than Blu-Ray 4k UHD discs. The downloads are often 40+ GB larger than 66 GB discs and downloadable months before physical media is available so the Kaleidescape movies stored on the customers' harddrive are very desirable files to hack and reverse engineer but so far, their DRM protection hasn't been bypassed. Kaleidescape is more locked down than the simple DVD CSS 40-bit encryption.
Sure, a Kaledescape owner could point a video camera at the screen and record it (the "analog hole"[3]) -- but those types of "rips" that suffer generation losses are not considered high quality.
[1] https://www.kaleidescape.com/systems/movie-players-servers/
[2] https://www.kaleidescape.com/news/kaleidescape-taps-nexguard...
Edit: it's actually mentioned in a comment not far from here (https://www.kaleidescape.com/news/kaleidescape-taps-nexguard...)