Most people don't realize this yet. They are taking other, existing projects which anyone could install themselves for a long time now and framing it like they built these things for their new fork. So much of their "distribution" is just a collection of other open source projects.
In the case of the security functionality, that is backed by a company named Search Guard who have an Enterprise Version in addition to the Community Version included in the AWS fork. They forked another project, renamed it and now call it their own.
https://github.com/floragunncom/search-guard-enterprise-modu...
https://github.com/opendistro-for-elasticsearch/security-adv...
They just forked the full code base and tried to remove any reference of Search Guard.
I am not sure what really happened here but this smells fishy.
The link is to a packaged, binary distribution of the 'OSS only' features, the assertion was regarding 'significant intermingling of proprietary code into the code base'. The two are not the same.
Also, from the release notes linked to from that page, Amazon's assertion that 'neither release notes nor documentation make it clear what is open source and what is proprietary' does appear to be valid.
Which is a wrong assertion, you can clearly see that it is an under Licence feature by the X-pack mention: https://www.elastic.co/guide/en/elasticsearch/reference/curr... above the name of the feature.