On the Kindle Fire we had a "secure enclave" bit of hardware so the files were encrypted with a key that was hard/impossible for users to get. I don't think regular android has anything like that, but they might use Widevine or something similar