Although your substitution is valid, it’s restricted. By defining x in terms of a sine you have restricted the possible range of x to [-1,1]. In that interval, the range of y is [0,1]. You could have used other substitutions with different ranges, and you would still, through back substitution, have arrived at the same result for dy/dx.
Initially y is defined in terms of x, where x∈ℝ. At that point y has the range (-∞,1]=(-∞,0]+[0,1]. But when you redefined y=cos²θ, you imposed a restriction on the range of y so that y∈[0,1] (partial range compared to the original range, so dy/dx is valid in the narrower domain of x∈[-1,1]), because of the substitution you chose. The two contrasting ranges imply that the substitution is not strictly a valid one in this case (even though it works). In the final stage of back substitution you implicitly removed the range restriction imposed by substituting x=sinθ, and tacitly restored the original range. You can use substitution for all sorts of reasons, without questioning or scrutinising the viewpoint of ranges, as a mechanical method for finding derivatives. The process of back substitution will usually take care of any range manipulations.