https://www.gesetze-im-internet.de/stgb/__202a.html
Roughly:
„Gaining access to data that is protected with special methods against unauthorised access, either for personal use or for others“
So apparently, hardcoded passwords baked into the client do qualify for that.
> https://www.gesetze-im-internet.de/stgb/__202c.html
English translation based on the DeepL translation:
"§ 202c Preparing the spying and interception of data (1) Any person who prepares an offense under § 202a or § 202b by
1. passwords or other security codes that enable access to data (§ 202a (2)), or
2. Computer programs whose purpose is the commission of such an offense,
or by procuring, selling, transferring, distributing or otherwise making available to himself or another person, shall be liable to a custodial sentence not exceeding two years or to a monetary penalty.
(2) § 149 (2) and (3) shall apply accordingly."