My reading is that ESE is intended to work in much the same way -- the main work is done by the Content Decryption Module, which is more plugin-like. And indeed, the way existing DRM-using systems work in the browser is with the embed tag.

The spec says "The Content Decryption Module (CDM) is a generic term for a part of or add-on to the user agent that provides functionality for one or more Key Systems."