With @martinwoodward’s blessing, I made a few commits today that switch to using preload="metadata" for all audio/video elements in all contexts, secure media included. This should fix the issue described here.
Note that if the user stays on the page for longer than 5 minutes, they will most likely not be able to play the audio/video, because the secure URLs are currently only valid for 5 minutes.