When theming the players, the module takes the file path directly from the files table in the database:
$file_url = check_url($base_url .'/'. $file['filepath']);

However, if private downloads are enabled, the system/files path should be used.
so the above line should be replaced with
$file_url = file_create_url($file['filepath']);

which checks whether the download method is set to private or public and generates the appropriate link.

I've tested this and it works. I think it should be implemented in the next release.