Usually whereby the open source kernel is signed, such that:
- The system will not boot if the wrong kernel is in place
- The system will disable DRM if the wrong kernel is in place.

DRM as required (err, petulantly demanded) by 3rd parties, generally requires top down security such that the:

TPM chip trusts the
boot loader which trusts the
kernel which trusts the
application

And if anything along that chain is broken the DRM can be compromised. Anything else is just intense obfuscation that can be broken by those with the necessary time (see AACS and software BD players.)