Quicker explanation of how Youtube is doing it is at the source code of pytube: https://github.com/tfdahlin/pytube/blob/bb890af3b271a616bbe1...

This is linked from the description of PR 30184 of youtube-dl but @varenc linked to a specific comment (talking about patching Windows builds, AFAICT) which might confuse some people.

I'll even save you the click:

> YouTube's strategy to restrict downloading videos is to send a ciphered version of the signature to the client, along with the decryption algorithm obfuscated in JavaScript. For the clients to play the videos, JavaScript must take the ciphered version, cycle it through a series of "transform functions," and then signs the media URL with the output.

There are still a lot of things I don't understand here but gotta give Youtube a slow-clap moment for their devious ingenuity.