Justman10000 Extiverse has built-in support for developers who want to make the source code available to subscribers. I think the idea is that it can be a separate, more expensive plan. I'm not sure which extensions use that feature.
In time, I am sure we will see paid extension with extensive code documentation. At the moment I'm personally only documenting PHP events from my paid extensions publicly but if a client wants to build upon the extension we can absolutely discuss opening more information about the source code.
Unless the developer made an effort to obfuscate the code, the PHP code is generally fully visible to the purchaser. If the code follows Flarum best practices and is correctly documented, someone should be able to tweak it. Whether it's allowed and what kind of support you would get from the developer depends on the terms of use. The javascript is generally not accessible in its non-minified version since extension developers don't need to include it in the distributed package of the extension.
On Extiverse at least, it's expected premium developers will provide support with bugs, so the subscribers shouldn't find themselves in a situation where they absolutely need to get another developer to fix their paid extension.
As for the prices... I guess we'll always find all extremes. As more developers create extensions for Flarum, I'm sure competing extensions in the market will help drive prices down. Currently it's very difficult for extension developers to recover the cost of development with so few subscribers, so high price / low volume is definitely a valid strategy.
