Very Disingenuous , AOSP standalone is rarely sold over the counter in a consumer droid phone, you could run it if you are interested, projects use it as a base but AOSP standalone is not the version most consumers run.

Every major version ports more functionality from AOSP over to GSF - which is closed source.

I cannot audit GSF and I cannot check for backdoors,, GSF phones home as it legitimate functionality, it is next to possible to verify back-doors don't exist. Location APIs could just be for your location, or google/ three letter agencies could be tracking you .

All the major OEMs include AOSP + GSF and then their custom layers. The only popular OEM using without GSF I know is Amazon with the kindle platform. To get Google certified OEM / use droid trademarks / use GSF you need to jump through hoops and give Google all kinds of access, not remotely same as open source.