Your statement is as wrong technically as stating that encryption cannot be open source. What matters are the keys, not the code.

The purpose of encryption is to secure communications between two trusted endpoints against untrusted intermediaries. Since all parties to the exchange are trusted and the intent is for both parties to have access to the data, an open source encryption system works.

DRM's purpose is similar, but one of the endpoints is in the physical control of an untrusted entity: you. Since the point of DRM is to prevent the user at one of the endpoints from accessing the data, if you have the source and keys to the destination endpoint (e.g. TPM, HDCP-enabled GPU), the endpoint can't be trusted, you can get the data, and the DRM fails at its purpose.