Almost. Just that it's the OEMs that choose to implement AOSP default privilege scheme to please Google so it gives them access to Play Store and all the other

Almost. Just that it's the OEMs that choose to implement AOSP default privilege scheme to please Google so it gives them access to Play Store and all the other Google apps. IMHO the leverage is all on the OEM side, they just choose to focus on hardware and allow Google to manage the software. Independent stores is something that was not really a thing before Android so we are figuring out as we go. Debian third party repos probably come close, but that is for tech savvy folk that know that they are doing. Now design that for your grandma.