Use a VPN service with a proven track record to connect to a seedbox paid for with crypto, and download only from top-level private trackers. It’s about as secure as you can get as a casual user.
In reality, though, a simple VPN is probably enough. Maybe not even that if you’re in a country that doesn’t give a shit.
Spotify, like most legit streaming services, use Google Widevine DRM, and you don’t reverse engineer it. At least not for the level that is required for this kind of content (L3). When you stream something in browser or device, the decryption module of that device is “talking” to the license server. If the identification goes through, the decryption keys are sent and the media gets played. So what you do is you extract that decryption module from a device, and then use scripts to send requests acting as that device, tricking the license server into sending you the decryption keys.
Once set up, and with the proper script, it can actually be even more efficient than other forms of piracy.
Uploaders and users with higher user classes get invites. You also get some minor perks if you donate, one of which is one invite. It’s $10 to get access to those perks. So technically, you could send a friend 10 bucks and he could invite you in.
I don’t think I’ve ever seen this forum mentioned on any recruitment thread like you would with private trackers, so a direct contact is probably the only way in. They’ve done a pretty good job at staying out of the spotlight since the domain change. It’s a pretty underrated place.