I'm not sure if bluetooth hacking is enough of a concern to be a problem? I've never heard of any major cases of it, and of all things, I doubt a music player would be a high enough value target for them to bother with? Could do something meant to spread to other devices, sure, but... I doubt the risk is high enough to be a primary concern.
Semi-related, but I did learn something: The modern name for MP3 players is DAP (Digital Audio Player), which can help with searching for them.