An article dated yesterday on a popular tech news website has revealed a lot of new details about Next Generation CarPlay, including that the software absolutely does mostly (but not entirely) run on the vehicles' own computer systems, not on the phone as it does today. This always made much more sense as the solution they'd arrived at based on the goals of the software, but we now have confirmation it is the case.
The article is subtitled "And many other notes about the future of Apple’s ideas for the car." and should be easily Google-able. I am not going to post a link here because I assume doing so would violate forum guidelines. Perhaps MacRumors will follow up soon with a report containing some of the same information soon.
At any rate, while the article does not allege that the software can run without an iPhone to set it up, it does claim that it can run even when the iPhone loses its wireless connection to the car which is a scenario I had brought up here as a potential usability issue if it were not addressed with that very sort of solution. Also mentioned is the goal to have Next Generation CarPlay be available from the get-go as soon as the vehicle is started up. Reading between the lines here, it sounds like you could indeed throw your keys to a friend while you stay home with your iPhone, and when they jump in the car they'll see the NG CarPlay interface if that's how you've configured the car to behave by default. They simply would not have access to things like your Apple Music, Contacts, Navigation History / Favorites, iMessages, etc., and likely wouldn't even see those apps available to use since it sounds like they'll still be running on your phone and merely projected onto the car's displays as they are today.
The article also mentions a pass-through mode where automakers are able to project their own native features within NG CarPlay's sandbox. This would hopefully address some concerns about yielding too much to Apple, although we still have yet to see this in an actual vehicle. Theoretically, I suppose, this could also allow Android Auto to be hosted within NG CarPlay, although that is purely speculative on my part.
It still seems like there is a tug of war going on between Apple not wanting to give too much freedom and automakers not wanting to give up too much control. But, with a heavily funded, high profile, influential automaker like Porsche reportedly trying to be an early adopter, you have to assume they are doing a lot the negotiation here (likely a big cause for the delays we've seen) which will hopefully lay groundwork for others to jump on board.