It seems like it would be trivial for Widevine to revoke access if there were ever abuse.
I have more details in a blog post I wrote last month. https://blog.samuelmaddock.com/posts/google-widevine-blocked...
If you had a private, proprietary fork of your browser that was being distributed and nobody else could modify it or contribute code that would undo the DRM, and you were willing to sign giant contracts spelling out in exacting detail what features you could and could not add around video (e.g. no download feature), and the Widevine people thought you'd actually have the financial resources to defend your private fork against hooking, memory overwrite and other attacks (you don't think proprietary Chrome is just Chromium+library, right?) in a long term manner, then they might have been willing to work with you. But then you'd be a company, not an individual open source developer.
Rights enforcement and open source are not compatible.