AOSP is made by Google. If Google decides to make something like app permissions worse again, that goes to AOSP, and is an extra burden for forks to deal with. Graphene already has to maintain a parallel system for storage permissions.
Control is limited by resources and compatibility. Google decides what goes in AOSP, so they could just design some changes that are difficult to revert or fix without breaking apps.