You need to remember that the status quo was Flash. It's absurd to try to pretend that a sandboxed decryption module is remotely comparable to a runtime roughly comparable in complexity to the browser itself.

Yes, it's proprietary and non-free. Everyone knows that and we can debate the implications but there's absolutely no possible interpretation where that isn't a huge win for security and stability.

The content decryption modules (CDMs) do have limited access to the browser (basically: here is a stream of data, render into this viewport), but there is nothing in the spec that limits what the EME modules can do to the OS (and the Windows Widevine one, for example, integrates with "Protected Media Path" which is Ring 0 code).

Even the W3C is skeptical of the security of CDMs: https://www.w3.org/TR/encrypted-media/#cdm-security.

Yes, but that's not introducing additional risk because the user was going to install it anyway, assuming it isn't provided by the OS or something like Chrome. If you're using content restricted by Widevine, you're exposed to bugs there no matter whether it's accessed by a CDM, NPAPI plugin, or a standalone app. Until consumers stop paying for encumbered content that won't change.

My point was about what we're not exposed to: bugs in Flash/Silverlight or exposed OS features being used in unexpected ways. That's a huge amount of code with a history of exploits and almost none of it is necessary to play a video but it's still enabled and ready to attack.