Does anyone contribute to AOSP besides Google? Does Google actually accept any patches into "upstream" and ultimately into their own commercial distro?

The phrasing of your first question is ironic given GrapheneOS has upstreamed a ton of their security hardening.

You're probably asking if they're able contribute anymore?

Why is it ironic? Sounds like an honest question from someone who doesn’t know.

Can you link to patches or commits they upstteamed? I'm not aware Google ever accepted any.

https://grapheneos.org/faq#upstream

https://android-review.googlesource.com/q/status:merged+auth...

Nothing in last 5 years; and if we ignore the last one, Nothing in almost 9-10 years. I am not sure how much weight it holds. Now if that's on Google on not accepting stuff that's different matter

What about issue tracker discussions, mailing list discussions, security vulnerability reports etc.?

Most of it is one liner config changes too, not much of actual code.

quite a few manufacturers do, specifically in the automotive sphere and ofc samsung etc.

in terms of accepting, unless it's stuff like bugfixes to core mechanisms, not really.