At least Flash was used widely enough that the vulnerabilities were found. EME means there are several competing vendors of proprietary DRM plugins that talk directly to video card drivers, all with unknowable security characteristics.

With the insecurity of being a closed source binary blob that has to duplicate a lot of the Web standard.