So, the only thing stopping a user from obtaining a clean copy of the content is the fact that the CDM is closed source? What if a CDM vendor leaked the source code? I guess the DRM server would block them after a while, but before they notice, the user would have free access to the content, right?
Here's how that works legally. DMCA 1201 actually comes in two parts: the first prohibits you from circumventing ANY technological measure (yes, even something as simple as a right-click blocker, domain lock, Youtube's rolling URL cipher, or what have you) and then lays out exceptions shaped similarly enough to fair use that the first part really doesn't alter the law beyond adding another tort to the pile. What's already infringement becomes infringement with a circumvention tort; and what's already fair use stays fair use.
However, the second part is rather broad. It prohibits the marketing of any sort of tool whose sole purpose is circumvention, lacks non-circumvention uses, or is marketed for circumvention. In practice, this means that there's a dividing line between DRM that can be circumvented with standard tools and those that require domain specialists to write you a tool. You can circumvent YouTube's "rolling cipher" by just launching OBS. You can't circumvent DVD CSS with anything but a specialized tool that falls under the second part of DMCA 1201 and is thus illegal to provide - even for otherwise legal circumvention.
(Yes, I know DVD CSS is laughably bad encryption; but the law doesn't care. You still have to write some code to brute force the laughably short ITAR-compliant key lengths.)
If the CDM vendor themselves released their source code, I doubt that would be considered a circumvention tool per se. If they had also started telling people to pirate movies while they still can, then they are violating the law. However, the CDM vendor likely promises to their customers not to do so, possibly in contracts and definitely implied in their marketing material. Releasing source moves the DRM scheme from the "domain specialists only" side to the "10 minutes with developer tools" side.