>Google removing your control of the OS

That is a feature of Play Services and not a part of AOSP which is what we are talking about.

>Or Google delaying security patches

Like it or not coordinated vulnerability disclosure is a thing in the industry and is done by other Linux distros too.