I think that is actually what they’ve already been doing for at least a decade?

Whenever you download a youtube video using something other than a js-enabled browser, then I think something like yt-dlp’s jsinterp.py needs to evaluate some javascript to extract the key.