Wait I thought they were running an entire browser engine

Over time they probably will require that. I believe YT still allows most of these things because of "legacy" apps, which they have been killing off bit by bit. I'm not sure if anyone is cataloging the oldest supported app, but most things like using YT from a slightly older game console don't work anymore.

Basically any publicly known method that can sip video content with doing the least work and authentication will be a common point of attack for this.