Google is doing their best to strangle those too, by only releasing their source code when a new major Android release comes out. Custom ROM developers then have to rebase and integrate several months of commits all at once, with nowhere near enough time or resources to actually vet more than a tiny fraction of the changes.