> It's been the general trend in web browsers to minimize the permissions you need to give to plugins--I would expect CDM plugins to evolve the same way.

DRM need control over the computer for it to ever do anything. Trying to sandbox DRM, is like trying to sandbox anti-virus software. It can't happen, and has never happened before.