Canonical allows third parties to make Ubuntu computers. Ubuntu computers still get updates, and the manufacturer doesn't have to push Ubuntu updates.
Android being open source isn’t the problem.
However with Android, companies sell 100s of millions of devices to consumers that are more concerned about price point than updates. There just doesn't seem to be the incentive for OEMs to care about it, if the majority of consumers refused to buy devices based on old OS versions or ones that didn't get updates, those devices wouldn't get made.