"Open source" has nothing to do with what ends up on your phone. It means that the
source code for the app is available, and (assuming you have the knowledge and experience) you can download it, modify it and make it work the way you prefer. The code that ends up on the phone is still an .apk file for installation, which installs Java object code.
Apple Music isn't open source. Apple™ is, as you see, trademarked for computer products (including software). Anyone putting out some malware names Apple Music would be at the wrong end of a trademark infringement lawsuit faster than you can download the app. (And someone else at Apple would be sending very threatening takedown notices to any sites that hosted it.)
Most suspicions of "my phone has been hacked" are ... we have a guide on that -
“I’ve been hacked”. (And, usually, you haven't been.)