Most of the time, they aren't - the Flash player simply requests parts of the publicly available file to play, most likely via RTMP, Real Time Messaging Protocol. Some providers will use encryption for some (Youtube, for example) or all of their files, most often RTMPS (RTMP over SSL, computationally expensive and secure) or RTMPE (RTMP using proprietary Adobe encryption, inexpensive and woefully insecure). Flash Media Server can also you client verification in an attempt to limit access only to clients that will not simply store the decrypted data, however the secret is widely known and this protection is therefore useless.
Regarding protecting the actual URL of the file, any number of techniques can be used - the server could, for example, give the client a key that is used to request the URL, but is valid only from a particular machine (as identified by, say, its IP address), a key that's only valid for a short time or one use, et cetera. Alternatively, the URL itself could be the key - linking not to the actual file, but to a fake location that is used to determine the target file and whether the connection is legitimate or not. Of course, if the actual transfer takes places over an insecure connection (RTMP, RTMPE, etc), it is still trivial to sniff the video in transit.