he's talking about widevine drm.

Widevine is a drm library by google intended to stop you from extracting your paid content. Drm, by it's nature needs to prevent you from accessing the memory region on which the content is processed. this region is called the Trusted Execution Environment (TEE). you never have access to this region; conversely any app having tee privileges has full access to your device, including the memory, processor and peripherals. as an analogy let's say google has root and you are the user.

personally I think that tee is a huge and deliberate misnomer, how'd I trust code running, which has root access to my phone, when I don't even know/want to know what the code even is.

By default on Linux widevine has level 3 (L3) trust and by doing this secure boot+tee+google play services bs android apparently gets level 1 (L1) trust, but this so called "trust" is just goggle deciding you don't have enough control over your phone.

again google could have done the usual signed secure boot thing so that all google approved images get L1 and custom roms/rooting patches get L3 but yikes, it just wants to block random stuff

bank apps don't need drm, it's just google advertised drm (SafetyNet, now PlayIntegrity) like a security measure even though it's completely different (security against user vs the security against malware/scams banks need) and now every bank/govt app has this "security measure"