Android itself does not "[spy] on basically everything you do", that role is given to the Google-specific services and applications you can - but do not have to - run on the thing. Neither is Android "vendor lock-in in a way we've never seen before", the source to the basic OS is available after all. The exception to this is formed by the device drivers which generally come in the form of "blobs" which are tailored to a specific build of the OS. This makes it unnecessarily difficult to make use of source builds, a situation which might be rectified by "project Treble" [1] but the jury is still out on this.
With the source to Android available and decoupled from the device-specific code it should be easier to create alternative Android distributions. This should also make it possible to upgrade Android on devices which have been abandoned by the vendor and those which never got any updates to begin with.
This is not just theory by the way, I'm using a number of Google-free Android devices myself. They run just fine without those Google bits, they don't spy more than any other device. This does not mean it does not spy at all but that problem is present in all mobile devices from all manufacturers and under all operating systems: the radio interface layer is a black box closed source blob in all commercially available devices that I've come across.
[1] https://android-developers.googleblog.com/2017/05/here-comes...