I can’t speak for Android Auto, but it sounds very similar to its sibling, Apple CarPlay. The latter requires a car’s (or boat’s) infotainment system to present little more than a touchscreen, sound card, and perhaps the charge or fuel level sensors to a connected device over either USB (as Type-C or Lightning) or both Bluetooth and Wi-Fi Direct. It’s perfectly fine for privacy as it’s nothing more than an extension of the phone. I don’t think it can even access the car’s own GPS. (I don’t know enough about CarPlay Ultra to advise you, so I won’t.)
You might be thinking of Android Automotive. That’s unrelated to Android Auto. Automotive is a full operating system that uses the car’s modems and GPS and you don’t get a say in the matter.
Correct. I understand it better than Android Auto, and it’s similar enough, so I use it as an example.