Composer installing two CI4 in the same project?

What Appstarter does are downloading this Github project and making copies of app, public, tests, and writable to your root. This is the Appstarter itself.

Those copied folder are Your project files, and that's where you should develop your app. DO NOT touch anything in /vendor/. If you update Appstarter with "composer update" it downloads a new complete package from the framework project above and place it inside vendor. So you will get fresh copies of all framework files. So you can for example copy a new mimetype configuration.

1. It's the same except the system folder have a different place.
2. It's in the right spot, that's how Composer and dependencies are loaded nowdays.

https://getcomposer.org/doc/00-intro.md