Yes, they run _within_ Safari. If you want to use them, you have to go to Safari and then enter the URL or choose a bookmark with their URL. "Sandboxed" is the term Jobs was using, I believe.
While I think some people will do great little (and big) apps for the iPhone this way, it's just not the same thing as real applications residing on the phone. If you want to work in a place where you're not allowed to be connected or simply don't have access to the 'net (planes, caves, trains in tunnels etc.), you don't have access to those applications. Now... Of course we're all connected to the 'net at almost all times - and increasingly so - but it just doesn't feel right.
Jobs says this is about stability. How 3rd party apps are wreaking havoc on mobile platforms like Palm OS, Windows CE (and descendants), Series 60 and so on. But I have to say two things to this:
1.) It'd be _your job_ to make sure that 3rd party apps couldn't crash the phone. OS X is a great platform, right? Stable and secure and all. They could've made restrictions for an SDK and make it work.
2.) These things run in *Safari*. Safari is not the app that never crashes. It's one of the apps that crash _most_ on my computers! Sure, it doesn't take down the whole _system_, but if I work on documents in such a web app, run calculations, organise my life etc., I don't want those apps' sandbox to crash and burn...
Just think about it: Where's is the access point for most attacks over the internet today? It's the browsers. If anything, they should've made sure 3rd party apps were _not_ connected to Safari in any other way than they could link to URLs that would open in Safari.