Can a malicious carplay device steal iPhone information ?

Theoretically, yes. Carplay can access lots of phone data - contacts, messages, reminders, calendars, music, podcasts, emails, .....etc. for display on the screen. In theory anything it has access to it can collect, store and do something with it.

None of your passwords are accessible to Carplay so you have to ask yourself what you are really concerned about. In theory the mass of data could be used to create a digital fingerprint, but if you use Google, Meta, Twitter or spend any time browsing the web then you're already fingerprinted to a much greater extent than Carplay would add to.

In the end you have to weigh the risk of using Carplay against whatever risk you perceive is associated with the very unlikely possibility of someone installing malware on your car and what that malware could do with relatively benign data like your contacts list and messages. If you're that concerned then you can restrict which apps can be accessed by Carplay and if that doesn't assuage your concerns then you have the choice not to connect your phone to the car.

I've got a VW. When I configure Carplay on the phone the following apps are allowed by default with no way to disable them for Carplay: Phone, Music, Maps, Messages and Settings. Phone includes Contacts. Any remaining apps can all be removed from Carplay.

If you're concerned then don't use Carplay.