According to this PDF, Widevine has three security levels. The least secure one, and the one used by Chrome on desktops is level 3 in which all decryption is done outside of a Trusted Execution Environment.
But in that case, what stops someone from opening the Widevine Chrome plugin in IDA and following the video data until they get to whatever function that decrypts it and then write their own implementation of Widevine that just saves the output to a file instead of rendering it?
The PDF does say that "appropriate measures may be taken to protect the cryptographic information and decrypted content on host operating system," but things like video games also use various protection systems, but these still get cracked with some effort.
So, why hasn't Widevine been cracked yet?