In short, they somehow obtain the Widevine L3 decryption keys, then they download the encrypted stream (Every browser downloads it while normal streaming, it’s trivial). The non-trivial thing is to get the decryption key and then to decrypt the encrypted file you’ve downloaded.

As to how exactly they’re doing it, it’s most likely a “secret” in order to limit the streaming companies in their capabilities to fix those “vulnerabilities”.

You, as a normal user, can buy a Software which can download from the most popular platforms. It’s called “Streamfab”. And if you’re a real pirate, you can download that piece of software cracked, too! Keep in mind that you’ll need valid subscriptions in order to rip directly from the streaming providers and at that point you don’t really need to download anything off of them, since you have legal access to their library.

But why go through that hassle and not just download the movie straight away from a P2P source?