‘event_params.source’, ‘event_params.medium’ and ‘event_params.campaign’ fields represent last-touch attribution at the event level.

These fields do not necessarily change for every event within a session. But it could change if a new traffic source is detected mid-session.
In other words, within a session, all events inherit the same ‘event_params.source’, ‘event_params.medium’, and ‘event_params.campaign’ unless a new traffic source is detected mid-session.
Because of this reason,
The ‘event_params.source’, ‘event_params.medium’ and ‘event_params.campaign’ fields do not strictly represent last-touch attribution at the session level.
For example,
If a user visits your website via Google Ads and no new traffic source is detected mid-session, all events during that session will have ‘event_params.source’ = google and ‘event_params.medium’ = cpc.
If the same user comes back mid-session via a new traffic source, says ‘Email Newsletter’, all subsequent events of the same session will have ‘event_params.source’ = newsletter and ‘event_params.medium’ = email.
If the same user comes back again mid-session but this time directly, all subsequent events of the same session will have ‘event_params.source’ = (direct) and ‘event_params.medium’ = (none).
So, within one session:
Few events could have ‘event_params.source’ = google and ‘event_params.medium’ = cpc
Few events could have ‘event_params.source’ = newsletter and ‘event_params.medium’ = email.
And the remaining events could have ‘event_params.source’ = (direct) and ‘event_params.medium’ = (none).