It mentions a few different sources which all seem to be free music (all lesser known artists) but the critical one is YouTube with a built in adblocker. The free music platforms might use ads playing between songs (that this client ignores) but it appears that some of them are intended as cheap libraries for commercial use. If you want some hip-hop song playing in a promotional video, Kendrick Lamar is going to cost a lot of money but some unknown artist is going to be much cheaper. These are what these libraries are for.

For my wedding, we hired a videographer and they sent us a link to a couple different libraries of accompanying tracks we had to pick from. I had never heard of most of the artists in there. The ones I had heard of were either indie artists or more mainstream artists that had an extra license fee attached to them. The libraries were an "all you can eat" sort of service but with some artists requiring one time fees for their tracks. Luckily, we found some great tracks from indie artist we knew that fit the vibe that didn't cost extra.

I think just youtube, soundcloud etc. But it seems to just...find everything.

Yes, seems like tongue-in-cheek humor. The project is supposed to stream from free sources, so no API keys are really needed for anything.

Yes, it does appear to be purposely so. The wisdom of this is debatable, but consider: for a shipped app, these keys would all be embedded in a binary regardless, wouldn't they?