I think there is a difference between Google branded Android and AOSP (Android Open Source). Anybody (users or carriers or phone manufacturers) can build and install AOSP, and Google can't provide updates or force them to install Google play store. Also, AOSP being open source is easier to tinker with (install apps from unverified sources etc.).

When media reports security bugs for Android, it is hardly clear whether the bugs affect AOSP or the Google branded Android, and to what extend.