It's not even private anymore. Anyone can easily find tools on GitHub or other sites[0] that can download widevine'd content. It's easy to find L3 keys on GitHub too. There are public sites[1] that get the decryption keys but using their own keys on the backend if you cant find keys or don't know how to dump the keys. There is an all-in-one tool[2] that lets anyone with 0 knowledge of DRM to dump content from practically any site that uses widevine, costs a leg but it's meant for people who don't want to waste time finding tools and learning how to do it manually.
[0]: https://cdm-project.com/CDM-Tools/