AOSP is just as open-source as desktop Linux (and desktop Linux subsystems reconfigured for use on a phone) is, and has vastly better security.

People sometimes say, "maybe desktop Linux lacks in security, but its privacy is first-rate," which IMHO is silly because if your OS can be completely and totally pwned by your visiting a web page, your opening image file or your using some IDE to inspect some source-code repo, how much privacy do you really have?

GrapheneOS is just as free from data collection by megacorporations as desktop Linux is and has about 1000 times better security.