It's not, really – AFAIK the audio is just AES-encypted with a per-session key that you get when logging in (but it's been a long time since I looked). There are a bunch of open implementations, like https://github.com/librespot-org/librespot – I guess it's kind of an open secret that you could rip music if you really wanted to, and you certainly used to be able to do that with libspotify when it was still around. I imagine the lawyers will come for you if you're silly enough to bang on about it.

Certainly there's no need for "special hardware decoders" – Spotify works on loads of devices that have no support for that kind of thing.