Each AOSP version is just a big code drop from Google. It's really far away in the spirit. Not even talking about how difficult it is to patch some component as a user.
Check out the current PRs in gerrit: https://android-review.googlesource.com/q/status:open+-is:wi...
There's about 5% of commits made by people with e-mail domain different than google.com, android.com or chromium.org (6% if you count the last one too).
Pretty much the same result on another one: https://android.googlesource.com/platform/frameworks/base.gi...
Do you get to see the code of yet unreleased versions of Android? Sure, they do accept some patches, but "developed in the open" doesn't seem to describe their development model.