They don't use official APIs (if you do you need to register a dev account and this sort of thing would most likely be against the TOS), just like yt-dlp they reverse engineer all sorts of apps youtube has (the webpage, the mobile webpage, the TV app, the android app, ...) and thus get all sorts of undocumented APIs to scrap from.
iirc it loads the page as if it were a browser, then scrapes and downloads the video.
What prevents YouTube from sending ad and the actual video in a single video download/stream?
Probably the cost of creating that stream realtime while ads spots are being bidded on