From the can.Component docs at http://canjs.com/docs/can.Component.prototype.scope.html
If you want the literal string value of the attribute instead of the attribute's value looked up in the parent scope, you can set scope properties to have values of "@".This means that if you want to bind to a value in the parent scope, you *don't* want to use '@' as your scope default value for the component.
This linked fiddle works just by removing src: '@' and using 'player.photoUrl' instead of '{{player.photoUrl}}' in the calling tag: