Before DRM plugins could access anything. Now they live in a sandbox which was not possible when they were NPAPI plugins. So the security story is actually much better as far as I know.
It still sucks to infect the web with this nonsense, but at least it can't do as much evil crap.
Now the DRM plugin can only access the DRM subsystem installed on your machine that has root enough access to verify your files, OS version, and graphics drivers, as well as a callchain allowing them to make draw calls to your GPU driver.
It still sucks to infect the web with this nonsense, but at least it can't do as much evil crap.