That is in fact, exactly what youtube-dl is doing. They download the JS code provided by Google, then use regexes to figure out which function is the function that Google provides for un-arranging the characters, then they load Google's JS into an interpreter and provide it with the Google supplied URL to get the original signature. See the code here:

https://gitlab.com/HacktorIT/youtube-dl/-/blob/master/youtub...

So yeah, Youtube/Google is doing (basically) nothing to protect the content, and for the absolutely token obfuscation they do use, they also provide you with the way to get right back to directly accessing the data without any protections.

The RIAA is lying in saying that Google is using technical protections, and they're lying in saying that youtube-dl is doing anything other than what Google tells them to do in order to access videos.