Well, that's kind of the problem of a fully open OS where the system administrator (root) can fine-tune everything.

The (technical) purpose of DRM is to ensure the stream goes through a certified channel. This means encryption on the wire, as well as ensuring that the image data, from the point of decryption to the point of display, isn't intercepted.

For this, the DRM module needs absolute, un-overridable control over the process. With root access, one can easily load a modified GPU driver that funnels the decoded image data not just to the output display, but to a separate buffer (a file). Or not even go that far but simply snatch the encryption key from memory and decrypt the streamed media directly. The list goes on.