it sounds like they could avoid user code accessing the room manager by wrapping it in an anonymous function, so their code wouldn't be accessible to other javascript. however, this analysis isn't really complete without looking at the http traffic that accompanied these script calls.
this would make it a bit more difficult, but it's hardly that simple. an easy way around this would be to make sure turntable loads your modified scripts instead of their own.