Since the driver is offering the hotspot connection through their ride hailing app, I presume it has necessary sandbox to protect the user activity from any other malicious app on that driver's phone. But I personally wouldn't bet on that , if I'm forced to use the hotspot offered by 3rd party then a VPN on my device would be mandatory.