Fair enough, that's interesting. I assume this only applies to the non-web clients. On the web, it would not be possible.
You can verify by looking at the outgoing network requests on this random video for example: https://invidious.privacyredirect.com/watch?v=qKMcKQCQxxI
Because of the CORS settings on Google's servers would tell your browser to not go forward with the request.
There are two ways it could eventually be possible:
By opening the video in a new page/tab that only contains the video, with the YouTube player, which defeats the purpose a bit.