Malik's learning curve
Bumrah, called India's yorker king, bowled Washington Sundar on the final delivery to reach a milestone 250 T20 wickets.
In reply, Rohit, who made 48, and Ishan Kishan put on 95 for the opening wicket to raise Mumbai's hopes of a chase.
Sundar denied Rohit a fifty and Malik, a standout performer for Hyderabad this season with 21 wickets, soon took over to rattle the opposition batting.
Malik, who hails from the Jammu region of Indian-administered Kashmir, started with a 17-run first over but came back strong with the wickets of Kishan (43), Tilak Verma (8) and Daniel Sams (15).
"Umran is on a steep learning curve," Hyderabad coach Tom Moody said of the 22-year-old speed demon.
"When it comes to international cricket then that's the path you need to take in time, whether that time is in months or years, only time will tell."
David, an attacking middle-order batsman from Singapore, then smashed T Natarajan for four sixes in a 26-run 18th over to give Hyderabad a scare.
But David was run out and with Mumbai needing 19 off the final 12 balls, Bhuvneshwar Kumar bowled a maiden 19th over and took a wicket to help Hyderabad prevail in the thriller.