It needs to download it from the CDN first. The actual implementation is your media are stored encrypted on a CDN for a certain amount of time then you receive the keys as an encrypted message.
I think Zuck himself said recently they're moving to encrypt everything and merge infrastructures for single login across properties (which a lot of us think is them sneakily trying to make their web properties a lot harder to split up in an anti-trust case).