Programming with dplyr with base-NSE only seems to work, too

I used to think that for programming with the dplyr verbs, quosures are needed, so to keep track of the enclosing environment. However, it seems that programming dplyr functions works with base NSE only, too - at least in the following instance:

stats <- function(df, col){
  col_q = substitute(col)
  df %>% 
    summarise(mean(eval(col_q), na.rm = TRUE))

stats(mtcars, hp)

Which works as intended. What I am missing? Where come the closures (remembering enclos. environment) come into play?