Where they got stung is the use of FFmpeg to transcode files. YouTube actually return an "InnerTube" key in the page response that can just be used to ask for the mp4 file of a video.

It's essentially exactly what the browser does when pulling in the video for playback. There is no manual decryption or anything of the sort involved.