Yes AOSP is open source but that doesn't help as much as one might hope for the reasons I outlined in my previous comment. Basically most end user devices aren't actually running AOSP at the end of the day, and can't without investing a nontrivial amount of effort. (And that still wouldn't prevent vulnerabilities related to out of date firmware.)
The comment of yours that I originally responded to seemed to me to insinuate that having access to fully open sourced phones wouldn't be able to do anything to improve device security as a foregone conclusion. I was objecting to that, pointing out that there are a number of real world examples where access to a fully open source mobile stack would immediately and drastically improve the current situation. In a hypothetical world full of such stacks perhaps this article would never have been written.
The iOS exploits that have historically allowed the device to be jailbroken have been zero-day vulnerabilities. And I'm assuming the TFA is about a zero-day too.
Also Android is open source (AOSP). How does that help?