As I mentioned in the last paragraph of #4334 (comment), the problem is regarding the minimum TLS version required in Open SSL's default configuration on newer distributions.

$ cat .openssl.cnf 
openssl_conf = default_conf

[ default_conf ]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT:@SECLEVEL=1

$ streamlink filmon.com/tv/e4 
[cli][info] Found matching plugin filmon for URL filmon.com/tv/e4
error: Unable to open URL: https://filmon.com/tv/e4 (HTTPSConnectionPool(host='filmon.com', port=443): Max retries exceeded with url: /tv/e4 (Caused by SSLError(SSLError(1, '[SSL: WRONG_SIGNATURE_TYPE] wrong signature type (_ssl.c:1131)'))))

$ OPENSSL_CONF=~/.openssl.cnf streamlink filmon.com/tv/e4 
[cli][info] Found matching plugin filmon for URL filmon.com/tv/e4
Available streams: low (worst), high (best)

A custom OpenSSL config with Python 3.10 on Arch Linux won't work. Apparently Python 3.10 hardcodes the list of allowed TLS ciphers with its default build arguments (which other distros / systems might be using as well):
https://wiki.archlinux.org/title/OpenSSL#Python_3.10_and_%22ca_md_too_weak%22_errors

A workaround is adding a different adapter for https requests for that specific plugin:
https://stackoverflow.com/a/59971965/15776887
https://stackoverflow.com/a/63349178/15776887
https://docs.python.org/3/library/ssl.html

"Transport Adapters" for specific hosts:
https://docs.python-requests.org/en/latest/user/advanced/#transport-adapters

from requests import adapters
import ssl

class TLSAdapter(adapters.HTTPAdapter):
    def init_poolmanager(self, *args, **kwargs):
        ctx = ssl.create_default_context()
        ctx.set_ciphers("DEFAULT:@SECLEVEL=1")

        return super().init_poolmanager(
            *args,
            **kwargs,
            ssl_context=ctx
        )

adapter = TLSAdapter()
self.session.http.mount("https://filmon.com", adapter)
self.session.http.mount("https://www.filmon.com", adapter)

That works nicely, thank you. Note, I also needed to add self.session.http.mount("https://vms-admin.filmon.com/", adapter) to get VODs working too.

Hmm, looks like it might need to be conditional for non-Windows systems?

Should I import is_win32 from compat and put the mounts in an if block based on is_win32?

Edit: I'm trying it anyway... if it's the wrong solution it can be changed.

Edit: Actually, that probably is the wrong solution. I didn't look carefully enough before, but I see this is only a problem on the Windows build with Python 3.6; builds > 3.6 are OK. https://github.com/streamlink/streamlink/runs/5129918618?check_suite_focus=true#step:9:255