Seems like spotify and apple music both do the same thing here. the js api creates an iframe to their "embedded player" which is just their full player without a ui which will respond to rpc commands from the page.
https://embed.music.apple.com/ https://sdk.scdn.co/embedded/index.html
Would be nice if paying users could access actual streams, although that would probably violate the drm or something.