The arstechnica story (linked in another comment) clarifies that the ring tone was injected in T-Mobile servers for calls that went over a SIP backbone. So yes we know it was not in the user terminal.

I cannot believe that T-Mobile would remote 'Celebrite'/jailbreak/root a device just to add the necessary files and remote-execute a process to play an mp3 while the Phone-app has taken control. When the Phone-app is running, it automatically thwarts any other sound-using app (such as Spotify, Music, Skype, games)

Carriers have enormous control over devices. While we now know it didn't happen, they likely could have easily shipped a manipulated standard phone app since when a carrier gives out a device it is often running customized firmware with the carrier's logo on boot and preinstalled bloat ware like Spotify, Facebook or WPS Office (by my experience with branded os images for Sony Xperias).