It uses an OAuth flow so you're actually entering your credentials on https://authorize.music.apple.com/ https://authorize.music.apple.com/ which gives this dev

It uses an OAuth flow so you're actually entering your credentials on https://authorize.music.apple.com/ https://authorize.music.apple.com/ which gives this developer a token to access your data (usually a limited subset of your data. I know on the Spotify OAuth screen it tells you exactly what data, not sure about Apple Music) So if your token gets hijacked then the bad actor would probably be able to view your playlists and listen to your music.