"Oh boy! I'm super excited to be running arbitrary code I downloaded from web sites against an API that was never security-hardened!"
Fortunately for me, my fears turned out to be overblown in that specific instance; there were a few security bugs, but they were patched with relative swiftness.
This reasoning, IMHO, ignores the fact that the user-agent still asks for consent, so the user may choose not to allow anything they can't audit. It's just the "Do you want to allow Flash to play this cool video?" story all over again.
Also, the comparison to Flash is not quite right. For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it.
Web DRM, on the other hand, is a standard that allows for an encrypted video stream to be decrypted. The only differences that I can see between this and the current state of web video are that now the stream can be encrypted. Everything else is still using Javascript, HTML, CSS, HTTP, h.264/265, etc.
The thing that gets me is that open-source browsers are free not to implement this extension if they're not comfortable with (or opposed to) it. The theory is that if companies start encrypting their content then open-source browsers will have to follow suit, but we already have that kind of junk; the difference is that now, with EME, we can keep 99% of the stack open standards, open-source, and auditable, rather than having to rely on Flash or Silverlight to do our decoding.
EME isn't the death of the open web, it's the death of the closed web. It's the death of awful, insecure, and obsolete technologies like Flash and Silverlight by taking the one single thing they're still good for and moving it to the browser. If EME failed and no one implemented it, Netflix wouldn't just stream their content unencrypted; they'd keep using Flash or Silverlight, or maybe implement something themselves so they didn't have to.
And, notably, the DRM modules can be sandboxed far more than Flash can.
Aaaand we're back to the days of good ol' ActiveX.
Another comparison to existing tech is Javascript. A lot of sites break if you disable Javascript in your browser, but if you enable it you open yourself to Javascript vulnerabilities.
So, it's similar in the sense that enabling JS increases the potential attack surface, just like installing EME/Flash/whatever does. But at least the JS engine can be examined by whoever wants to.