They could, but it would be a herculean effort. Google has multiple thousands of developers working on Android (exact number undisclosed).

Every Android custom ROM is already a fork of AOSP that backports any new updates to AOSP into their project when source code is provided to AOSP. That is work enough already for a small team - if they were also writing those security patches for published CVEs and as well as patching bugs submitted by users and Android partners (app devs) as well as developing their own feature updates to keep similar parity to Google's Android, that would be several orders of magnitude more complex and require a large team working full time.

They'd also need to develop relationships with any Android hardware manufacturers that they wanted to support the devices of, to get current and new drivers and work with them over any problems - with no real reason for those businesses to work with them, especially if Google could turn around to them at any time and say something like, "if you want to continue partnering with us you'll have to sign this new exclusivity contract that stipulates you'll stop providing pre-release drivers and direct support to any AOSP fork project." So it could realistically be sabotaged at any time by Google (in this way or others) making it a fairly unattractive proposition for open source devs to pour their time into.