For your first question, yes anyone can download packages. DAML code is intended to be public.
As for your second question, you are right that the config management service is not exposed in a nice way in the Java bindings at the moment. However, you can access services directly reasonably easily. @bernhard provided an example of this for the party management service in Java Bindings do not have all Ledger API services. I’ve opened Expose config management service in Java bindings · Issue #7877 · digital-asset/daml · GitHub to expose this is in a nicer way in the Java bindings.