I have never seen those questions answered because it’s a secret sauce that the streaming platforms would patch immediately if it were published. In general though, my understanding is it’s older versions of apk’s on rooted android devices with exploits that allow for harvesting the actual cached files, or in some cases the apk is deconstructed to get access to the API keys so that the files are downloaded directly, though that’s risky as it gets easier to detect a single key doing a giant pull of files faster than someone could reasonably watch the shows.