To my understanding, Widevine has two modes: L1 and L3. L3 is software protection where the browser protects against most simple reverse-engineering, but sends an unencrypted video stream to the OS' window compositor, so you can still screen record the content if you'd like. L1, on the other hand, requires a full chain of trust, meaning the encrypted video stream is sent to your GPU unit (or TV SOC), and the GPU has safeguards to prevent the OS from being able to capture that part of the screen, and most importantly has a HDCP handshake with the output device.

When a service is selecting which streams your client is granted a license to, if you claim L1 protection, the license request includes a signature from the GPU/chip doing the decryption, so the service will know whether your device only supports L3 software protection, or has a full chain of trust for the content and thus can protects against things like the user screen recording video content. Chances are the contracts rightsholders have with Netflix et al. require L1 for HD or UHD streams, and only allow L3 420p streaming (note that Netflix Originals seem to stream at 720p on L3, at least from what I've heard).