Earlier quoted context omitted.
AOSP may be open, but on its own it is a skeleton of a OS. Most of the magic in Android today is housed in Play Services, one of two things Google can push an update for (the other being the Play store app) without any dialog or concent from the device user.
That's kind of a demon of necessity though. Originally they did things more in the base OS but getting manufacturers to actually push updates was horrible. Now they can do bug, (minor) security and feature updates through a side channel that bypasses the carriers who don't want to update their older phones when people might go buy new ones instead.
This makes a lie of the whole notion that Android is open source. Yes, the skeleton is open, but the guts are proprietary. And the skeleton on its own is useless.