According to reports, Plex' intention was to prevent clickjacking, which is perfectly reasonable but left many of their users from being able to use their Plex servers within the HTPC managers.

Would doing something like this, obviously replacing example.com with their own domain.com, replace the offending header?

  addEventListener('fetch', event => {  
    let request = event.request;
    if (request.headers.has('X-Frame-Options')) {
      let newHeaders = new Headers(request.headers);
      newHeaders.set('X-Frame-Options', 'ALLOW-FROM https://example.com/');
      event.respondWith(fetch(request, {headers: newHeaders}));
    }
  
    // Use default behavior.
    return;
  });

i'd venture to guess many build the binary themselves already. so they can add their own tweaks.

how would anyone be able to prove a website is being ran by caddy if the server doesn't announce that it is caddy?

This part is incorrect. Plex only needs to transcode at the time the media is being played and really only scans when changes to the media directory are detected and/or on a schedule you define.