All the technical descriptions I've been able to find say that when CarPlay is in use, the phone and its apps are in control of everything that goes on. It's basically similar to the older AirPlay system, which allows Apple devices to control compatible speakers and TVs. It's not a general purpose network router like the WiFi Hotspot, so the car can only do what the CarPlay-enabled apps tell it to do.
So unless Apple has an undocumented feature that allows the car to use it as a hotspot via CarPlay, it should be considered safe from this. Apple in general is very concerned with security, so this would be very much out of character for them.
Separate from CarPlay, if you enable the WiFi Hotspot on your phone, and your car has WiFi, it could tether to your phone and access the Internet this way. But from my experimentating, it's not possible to use the hotspot while CarPlay is in use. When I enabled my CarPlay connection, my tablet didn't see the hotspot in its list of WiFi networks.