I'm not going to defend plugins as they were (a plugin-based DRM solution would not necessarily rely on the <embed> tags), but they were migrating to run in san

I'm not going to defend plugins as they were (a plugin-based DRM solution would not necessarily rely on the <embed> tags), but they were migrating to run in sandboxes before flash died. Chrome shipped flash-as-locked-down-process from early in its history. EME code, however, can have deep hooks into the OS, especially on mobile.