Does EME prevent new browsers from implementing it freely. I admit I haven't read the spec but from what I've read second-hand, it seems like it enables the vendor to ship the DRM code as a binary blob that runs natively in a sandbox.

As I understand, EME doesn't lockout new browsers, it locks out new architectures and kernels. But any new architecture that comes along that anyone would want to use to view DRM-encumbered media would be mainstream enough that content providors would support it, and people running an experimental OS kernel already have to use a more traditional system for a lot of things, and probably aren't a demographic too keen on DRM in the first place.