Someone more knowledgeable than me will hopefully respond re. intercepting the dbus calls to 'externally' modify the app behaviour but re. the code - as I understand it the source isn't password protected, it's unpublished. The app is only a binary (i.e. the compiled executable version of the code).

Meantime, I don't actually understand the bug you reported - do you mean that other audio app(s) and/or web audio content is being controlled by the cam key when the phone is locked? Or do you just mean that with the media player open, but not currently playing & not paused, it reacts to the cam key by starting to play whatever may be in its playlist? I can't replicate either scenario, so curious to know what exactly the issue is.