A "composer create-project codeigniter4/framework" creates the project, but the composer dependencies in it refer to third party packages, and I am not sure if "composer update" will work as you intend.
Any project which is based on the framework directly will have the same problem going forward, and that has been true with CodeIgniter 3 too.
We have a new (and experimental) solution: the CodeIgniter4 app-starter. It comes only with application & public, and the "framework" is composer-installed inside "vendor". A "composer update" after this would then update the nested framework
Yes, that means re-building your project folder, but hopefully only once!