I'm pretty sure they could implement the same transport controls that my cassette deck had in 1989. They could also enable additional features when the vehicle isn't moving, if they cared enough to do so.
What's not safe is providing an app that's so frustrating to use that it encourages the driver to touch and grope and scroll and drag all kinds of different things, looking for a commonplace UI affordance that, surely, has got to be there someplace, yet somehow isn't.
Or (worse) providing an app that frequently (but not always) fails to return to the same screen and playback state that was active when the engine was last shut off. That's the #1 unforgivable sin in any autosound system, and... yup... they somehow managed to pull it off.
It's as if the Spotify dev team is managed by B. F. Skinner himself, and they think we're all a bunch of lab rats.
Honestly every car app I've used is just terrible. VLC locks out half your artists (it does unlock when you're stopped). Maps blocks limits the keyboard and forces you to use voice.
I'm frequently disconnecting my phone, doing what I want, and then reconnecting it. This defeats the entire purpose of car play other than that my GPS is displayed in a place that is visible to me. I'm sure the play engineers have thought long and hard about how to prevent certain behaviors. But I am not confident they watched people use them in the real world. People are very good at finding ways around limitations. It's impossible to think your way through this without actually observing people. I'm not so sure it is Skinner and lab rats but "we're smart and thought about everything." I'm sure you're smart, but no one can think of everything. Thinking that makes you not smart.
Worse, there's no passenger mode for these apps and most of them don't lift restrictions when you're stopped. The lack of these features adds to people not stopping and just doing more dangerous things.
But I am not confident they watched people use them in the real world.
Oh, rest assured, they do. Time spent screwing around trying to get the app to do what you want is considered "engagement," and treated as a target for optimization.
Honestly the controls are so limited that it makes me end up picking up my phone, disconnecting it, selecting the song I want, and then reconnecting it. This is a much more dangerous behavior.
The problems here are that it is SO limited that it is very difficult to accomplish a task. Beyond that, even a passenger can't navigate the app easily. You can't do anything when parked either. Even maps has this problem where it essentially forces you to use voice command but that doesn't work well so you say the same thing 5 times trying to get it right or do the above thing where you disconnect.
Car Play is one of those things where it seems like the developers thought long and hard about how to do things but didn't actually look at how people use the system in the real world.
So it's basically radio+cassette player