They could use CENC and just serve one version with two key management systems, but I think they do serve two versions in practice.

And yes, by and large. Widevine offers a bit more than just being closed source in terms of Google doing breach monitoring and fixing but yes.