I wouldn't agree with that---media players are often fed untrusted content from the Internet, so a security issue in a shared media player API can be critical.

I wouldn't agree with that---media players are often fed untrusted content from the Internet, so a security issue in a shared media player API can be critical. See the Android StageFright vulnerability from a few years back. Writing it in C for a marginal performance gain just isn't worth it.