In theory, no not really. Everything required for your browser to obtain the stream must be provided in the webpage, so it's always possible for something else

In theory, no not really. Everything required for your browser to obtain the stream must be provided in the webpage, so it's always possible for something else to pretend to be a browser and get ahold of the stream. In practice, they could combat the practicality by various methods, like embedding the ads in the video stream, throttling the stream to hurt the use-case of downloading vs watching (they already do this I think).