First, you aren't talking about the average consumer anymore. If we're talking flashing operating systems, sideloading kernel updates and boot loaders in order to feel secure about your mobile device, then an older, vertically supported iOS device is probably a better bet.
Secondly, AOSP isn't forever. After your carrier/device-manufacturer drops support, Google isn't that far behind. If you're not getting AOSP drops for your device that work with device drivers then it's probably dead. There are a few brave souls willing to port modern Android to no-longer-google supported devices, but I wouldn't call that sure-fire security.
Thirdly, many AOSP derivatives and communities have niche motives that don't really align with the average user. New OS features, experimental "battery saving" kernel hacks and user-space root are commonplace where they really shouldn't be for the average, or arguably any, mobile user. Often devs get a new device and the community quietly moves on, dies, stops providing.
Mobile software is really in a sore place right now overall and neither duopoly is 100%. The incentives aren't aligned to the consumer.