One point that I don't seem to hear a lot: You can still block ads on YouTube in the browser, but you can't in the mobile app. The difference is that in the browser you can open the page and inspect everything that it consists of. In the app everything is bytecode. The solution of stripping ads from the YouTube app is to maintain a hacked version and follow a convoluted multi-step process to root your device and disable signature verification just to be able to install it. What will the solution be when webpages bundle both the content and advertisements into inseparable binary black boxes?

I think the population that consumes YouTube in general is much larger than the population that consumes paid content with DRM, and there would be a much larger pushback if webpages like YouTube started to be distributed in compiled format.

This has nothing to do with bytecode and everything to do with the security models used by Android and iOS.

Ad blockers don’t work by inspecting the source code of YouTube’s JS and modifying it. Instead they inspect the network requests being sent, cookies being stored, elements being created and with which styles, and so on.

WebAssembly changes none of those things.

Isn’t EME limited to media sources? WebAssembly is not.

It’s not a tiny difference, and skepticism is not necessarily unfounded.

Sufficiently obfuscated JS isn't easy to read either.

I believe you mean “deny box”?