It's a compromise between what the rights-holders want for security (eg: usually more), and what the hardware vendors can reasonably implement and profit from (

It's a compromise between what the rights-holders want for security (eg: usually more), and what the hardware vendors can reasonably implement and profit from (eg: usually less), and the degree of hassles and adverts that the end users will tolerate (some), and the trade-offs between the ease of use of any cracks with the fear of and the threat of and the costs of legal entanglements, and the cost of entry for folks outside the consortium (usually licenses and patents). Everybody involved - content, device, user - is looking to maximize their profit and minimize their costs. Hardware guys: No content, no buyers, uh-oh, no device sales. Content guys: No devices, no market, uh-oh, no media sales. Customers: No fun, uh-oh, no device and no media sales. It's one of them marketing min-max messes, in other words.