Sometimes, yes, but not intrinsically. AOSP performs OS and app update authenticity verification via predistributed public keys, as do package managers. In theory, a phone’s firmware can be completely open source and still be unmodifiable. Proprietary software isn’t any more opaque or protected than open source software.