I remember of projects that failed because Widevine explicitly didn't work in their Chromium. I assume that Widevine builds nicely but requires a Google-issued key to work.

Yep! Which is why the Arch package just extracts it from Chrome and then puts it in the right place for Chromium.

I mean if you could just build Widevine and decrypt content it wouldn't be very good DRM.

This is fine for power users who care enough to do it. But for the general public, as well as companies which would need to do this if they wanted to support DRM in their own kind of browser, it is not going to fly with Google and probably isn't legal.

You don't "build" Widevine. Google distributes a binary (libwidevinecdm.so) which implements a standard API that works with both Chrome and Chromium. The "master" DRM secret key is obfuscated and distributed in libwidevinecdm.so itself.

And no pirate has been able to extract the key yet?

It was broken: https://twitter.com/David3141593/status/1080606827384131590 But now we are getting kinda off topic which is that Widevine DRM does work with Chromium.

Interesting, it's a shame we never saw more (a PoC or write-up) following that though.

What difference does that make? At that point you are no longer playing by the book.

probably one has been as determined as breaking games protection