It’s hard not to oversimplify. Fundamentally you need to understand the concepts behind secure store and security attestation. I can give you an example:

With Windows 11, MS can guarantee Netflix or Amazon that the 4k Dolby movie you are streaming from your web browser cannot be ripped and pirated. With Windows 10 they could not make that promise. Though it was very hard to do in 10, it was always technically possible. With an SOC level secure store and properly implemented stack, it’s technically impossible. Of course, there are always going to be good old HW and SW implementation bugs that will be exploitable, but the folks who can do it are in for a rough time.