The docs I read (and yes like you my job relies on me being vaguely tech savey) but someone else can correct me ehere I go wrong
Server sends you app data e.g.youtube.
You receive app data but have extentions that fiddle with data. Not necessarily ad blocker could be any tamper monkey script or a relatively unknown accessibility extension that makes the page palatable.
Browser runs off to authorised entity e.g. Google but they are proposing others (all others I have seen named are big corporate cunts like ms and fb)
They check what’s on your screen and if what’s on the page matches what was sent we all good. If not they can block your access.