Android Open Source is good enough. The tough part are device-specific drivers that never make it upstream and are eventually abandoned by the vendor, making upgrade past specific kernel versions very troublesome.
It seems like a waste not to use an existing, well-developed, hardened, open source base, that at the same time provides great compatibility with most existing apps.
Since it is open source, it would always be possible to fork if AOSP goes off the rails.
I think the primary issue is that it is currently hard to get embargoed security patches, unless you have some partnership with an OEM.
It's "some sources available"