What do you mean he got a license? It doesn't sound like he dealt directly with Widevine to me. It sounds like he reversed engineered some existing application.

He used a legitimate endpoint to dump the license