Yes, I believe the MCU takes the file from the SD card, saves it in local memory, then sends it to the chip to be decoded.
I know because the SPI interface works as a slave only; and also because the library makes use of the SD library (aka the Arduino has to retrieve and stream the data).
How did you yield the max bandwidth for an AVR?
Well, in SPI, the maximum "raw" (without execution or protocol overhead) data rate is half of the CPU's clock frequency. So at 16 MHz clock frequency, the maximum "raw" or theoretical speed is about 8 Mbit/s or 1 MB/s (almost 8 times the required rate for CD-quality audio streaming).
However, in a more realistic application, the effective speed is way lower.
For example: a single read operation from a file can take around 64 microseconds when the library has to load another block of data (512 bytes to be exact); but if the file is fragmented, more filesystem overhead comes into place and the operation gets stuck for up to half a millisecond.
Based on a test I've made long ago, the read speed of a file on a SD card with the IDE's library, topped up to somewhere around 70 KB/s (without sharing the bus); and not 1 MB/s.
As you can see, there's a lot going on that theoretical speeds are practically impossible.
By sharing the same bus gets even worse; because of its nature, you can only access one device at a given moment; so the access time has to be "sliced" for both of them.
Having two hardware SPI ports won't help either, not without DMA capabilities from the CPU.
is this the max bandwidth of the MCU or the SD card?
Mostly the MCU. So much so that the maximum serial clock frequency supported by the card is 20 MHz, while the micro just can offer up to 8 MHz.
The other limiting factor could be the decoder ifself, which is very unlikely considering that it needs to receive data from another (master) source; sort of like an I2S DAC.
I did not know wav files required such a high sample rate.
That's the disadvantage; the advantage is that it requires minimal processing to actually play it back. So minimal that an Arduino can play WAV files on its own (besides the fact it needs an SD card due to the already mentioned big data volume).
Although the sampling rate doesn't matter that much unless you are an audiophile. 22050 Hz still sounds fine for most people; lower than that is more accepted for things like speeches.