Idea is to catch dbus messages generated when screen locked and unlocked and then use playerctl tool to control playback. This heavily modified approach from Reddit

  1. install playerctl. How to do it depends on you distro, for Debian it just apt install playerctl
  2. Put following scrip somewhere in your home folder. ~/.local/scripts is a good place as any. Make it executable and ensure that nobody but you can write to it. Put following to ~/.local/scripts/pause-media-when-lockscreen.sh for example. 
     #!/usr/bin/bash
 RESUME="No"
 PLAYERS=()
 /usr/bin/dbus-monitor --session "type='signal',interface='org.gnome.ScreenSaver'" |
   while read x; do
     case "$x" in
       *"boolean true"*)
            # Lock and unlock signal are getting sent twice for some reason. So be sure that we test only once.
            if test $RESUME = "No"
            then
              A=(`/usr/bin/playerctl -l | /usr/bin/awk 'BEGIN { a = ""; }; { a = a ""$1" "; }; END { print a };'`)
              for i in "${A[@]}"
              do
                if test `/usr/bin/playerctl status -p "$i"` = "Playing"
                then
                  PLAYERS+=($i);
                fi
              done
              if test ${#PLAYERS[@]} -gt 0
              then
                RESUME="Yes"
                for i in "${PLAYERS[@]}"
                do
                  /usr/bin/playerctl pause -p "$i"
                  echo $i "was paused"
                done
              fi
            fi;;
       *"boolean false"*)
           if test $RESUME = "Yes"
           then
            for i in "${PLAYERS[@]}"
            do
              /usr/bin/playerctl play -p "$i"
              echo $i "was resumed"
            done
            RESUME="No"
            PLAYERS=()
           fi;;
     esac
   done

    What does do. It listen to “org.gnome.ScreenSaver” events using dbus-monitor. when signal received ( for some reason that signal is sent twice ) it records all players which are plying in PLAYERS variable and then pause them. On unlock it will send “play” message to these players. “org.gnome.ScreenSaver” is Gnome Shell specific message, to use this script with XFCE KDE etc you will need to modify signal name and match criteria.

  3. Make it start automatically in background on login. My system already smeared by systemd, so simplest way is to use it to run it.
    • Create a file ~/.config/systemd/user/pause-media-when-lockscreen.service with content 
      [Unit]
Description=Pause all media when screen is locked
After=graphical.target

[Service]
Type=simple
ExecStart=%h/.local/scripts/pause-media-when-lockscreen.sh
Restart=on-abort

[Install]
WantedBy=default.target

    • Enable it by running

      systemctl enable --user pause-media-when-lockscreen

    • And start it manually in first time

      systemctl start --user pause-media-when-lockscreen

  4. You can always check what script is trying to do by looking in ssystemd status on journalctl output.

    systemctl status --user pause-media-when-lockscreen

Updated: