>They’d need dedicated hardware to enforce any kind of effective DRM.

That's already here. Even random aliexpress tablets support widevine L1 (ie. highest security level)

maybe to stop the .01%. switching to app only, sign in only would get them pretty much all the way there.

They own the os, with sign-in, integrity checks, and the inability to install anything on it Google doesn't want you to install they could make it pretty much impossible to view the videos on a device capable of capturing them for the vast majority of people. Combine that with a generation raised in sandboxes and their content would be safe.

I guess at that point we could do it the old fashioned way by pointing a camera at the screen. Or, I guess, a more professional approach based on external recording.

Netflix is already there for 4k streams

Can you explain in simple terms what would prevent one from running the decryption programmatically posing as the end client?

Which is why Windows 11 requires TPM.

iOS can already attest to websites that they are running in unmodified Safari. https://developer.apple.com/news/?id=huqjyh7k

I guess that isn't quite enough to prevent screen recording but these devices also support DRM which does this.