Is it?

Android uses Apache License 2.0, which means vendors can modify and distribute without publishing their modifications, like include proprietary blobs and other binary code.

It’s like using Google Chrome instead of Chromium.

Yes you can debloat the system, but many system apps can’t be disabled without breaking the system, and ROMs based on AOSP the code can be reviewed or modified and built it yourself.

Xiaomi and mostly stock ROMs these days come bundled with ads, and apps that collect user data, even with debloat or DNS blackhole isn’t 100% private or better than a custom ROM