It starts with a paying subscriber.
Creator content leaks almost never start with a hack. They start with a real subscriber — someone who paid the subscription, stayed long enough to download or screen-record the whole back catalog, then cancelled and reposted everything somewhere else. DRM helps investigators track copies, watermarking helps prove ownership, but neither stops the download from happening. Every major leak forum runs on content that was paid for at least once. The pirate is a customer. Which means the only effective defense isn't preventing the download — it's finding and removing the copies after they surface, and doing it fast enough that the leak doesn't metastasize.