The "proprietary" codec support is open source but disabled by default in a Chromium build unless you pass proprietary_codecs=1. Why? Patents. AFAIK, Google pays for a license from the patent holders to decode the codecs within Chrome, but not an open-ended license for anyone using the source code. This is not their fault and no different from how many Linux distros don't include MP3 decoding by default. (Incidentally, the last MP3 patent is set to expire at the end of this year…)

Yup. Our only closed source bits at this point are Flash and the Widevine CDM (DRM), both of which can be disabled from: Settings -> Content Settings.