Spotify requires Widevine CDM to run, and Firefox doesn't come with Widevine on Debian-based distros. The .so hasn't been available on arm64 except for ChromeOS. You can rip the .so out of ChromeOS (that's what RaspberryPi OS did). But ChromeOS uses its own flavor of libc so a couple of patches to glibc are required.
Same thing with YouTube. A few months ago, YouTube started to require Widevine CDM if one uses the m.youtube.com site. I can't use the non-mobile site on my phone for performance issues, so I'm essentially locked into Widevine for watching YouTube, too.
Turns out you’re right. I just uninstalled the CDM and YouTube indeed works!
I’m still absolutely, positively sure that m.youtube.com started gating it for me last August without a doubt. [0]
Maybe they pulled some temporary A/B experiment on me? I’ll probably never know. Thanks for the correction.