DMCA 1201 has a knowledge requirement, so in the first example, someone just viewing the website normally has no knowledge of the DRM and thus isn't circumventing anything. However, if they had known of the proprietary client beforehand and used a regular web browser to circumvent the DRM, then that would violate DMCA 1201's anti-circumvention provisions. However, keep in mind that anti-circumvention is the sane half of the law where all the actual exceptions for fair use and all that live. And also the half of the law that's significantly harder to enforce.

The second half of the law is the anti-trafficking provision. This is a lot stricter because it has no fair use exception. However, the actual requirement for violating this law is that the tool has to either...

- Be only capable of violating the DRM scheme

- Have limited commercial purpose other than violating the DRM scheme

- Be advertised as being capable of violating the DRM scheme

Just selling a pentalobe screwdriver is not enough to trip the anti-trafficking part of DMCA 1201. Either your DRM system has to have special screws that only that particular device uses[0], or you have to specifically sell it as a way to steal music. Pentalobe screwdrivers have all sorts of significant commercial uses other than just breaking this hypothetical DRM scheme.

For the same reason, you misusing Bitlocker does not make Microsoft liable for violating DMCA 1201, because Bitlocker has a very wide commercial purpose outside of circumvention. However, if someone says "hey the key is all zeroes", they are liable for trafficking in circumvention tools. Generally speaking, DRM needs to be narrowly tailored to avoid overlap with commonly-available and thus legal circumvention tools. If you abuse existing functionality to make DRM in a way that is trivially circumvented then you gain very little from anti-circumvention. For the same reason, those little right-click blockers people used to put on their website don't mean that Chrome DevTools is illegal[1].

Your ransomware-by-FairPlay example is actually legally interesting. I could see it going all the way to SCOTUS. If I were a cybercriminal, I would absolutely do this just to see people hold off on releasing unlock tools. That being said, I don't think a judge would actually find a security vendor liable here. There's a very basic principle in law that illegal activity is afforded no protection by the law[2]. So I can't sue a drug dealer because he spiked my heroin with fentanyl, or sue a game developer for using my unauthorized fanart of their characters without permission[3]. The criminals who released the ransomware cannot sue the security vendor, the DRM system vendor would have to be baited into doing so. Furthermore, "decrypting shit that was encrypted without my knowledge or permission" would be a perfectly valid commercial purpose. So as long as the security vendor does not say "this tool decrypts DRM" it's probably fine for them to release this.

[0] For various economic reasons in screw manufacturing, this is highly unlikely to ever exist.

[1] I'm pretty sure just mentioning this is committing one of my three felonies for the day.

[2] This does not mean that criminals have no protection under the law at all, of course. Someone who burgles your house and gets injured can still sue for damages, because it's illegal to set up traps to kill people.

[3] Under US law, if an artistic work is a derivative of another artistic work, the derivative is afforded copyright protection if and only if it is licensed. If it is unlicensed you own nothing.