Look at the security track record of all plugins. Notice how few of the vulnerabilities are in the actual content decryption code as opposed to the code duplicating things the browser does natively? Also consider how sandboxes the CDM interface can be if it's just passing data through to decode.

That's why this is such a big improvement.