And if netflix spent that 10 million again you'd have a TiVo and NOT a general purpose OS. And the OS simply can't not touch the decrypted stream because its the kernel that has to deal with caches, timings, and schedulers. If you have access to the kernel then by the very fact that for an OS to function (and for your video to not be a slideshow) the kernel HAS to have access to determine when the buffer, when to lower the priority of other tasks, and when additional resources is needed the DRM simply wouldn't hold.
Its like how many games and videos will use the Readyboost on my Win 7 system. there is NO worry about using that, even though it can be simply unplugged at any time, because the entire cache is encrypted and the user doesn't have the key...but the kernel does. if one could reprogram the kernel one could lie and simply tell it to buffer onto this SSD that is "encrypted" but in reality would be encrypted with say all zeroes for the key. Again there is no way for the DRM to know this without layers of checks that would slow the whole system to a crawl and even then it would only work on a tiny subset on Linux distros and even then in only certain releases because the amount of testing would be insane.
With Windows and OSX they only have one release every 3 or so years, only one version (all the higher versions of Windows are just supersets with the same core) and most importantly it restricts the user from the core files so that one can't simply substitute core files or the kernel after installation so those extra checks simply aren't needed.
If you look at the way kernel are built and behave what you are asking for simply can't be done on an open monolithic kernel, it just won't work. it MIGHT work on a microkernel, where nearly everything is done as a module on a higher level than the core but Linux isn't a microkernel and to design the system around that idea would basically mean starting over from scratch. I mean do you honestly think in the entire 20 years of Linux development that someone hasn't wanted to add a DRM module? The reason it hasn't been done isn't a question of money, its a question of design. Its like saying you could build an economy car that could pull the same load as a full size dualie pickup. Sure you could eventually bolt in a big enough motor, transmission, suspension, etc but by the time you are done its really not gonna have anything in common with an economy car is it? I bet if you wrote Linus himself he'd tell you the same thing, there just isn't a way to put protected path into Linux, it just can't be done.