That's just the bargain Google struck with carriers and OEMs. They have the reins on Google services, but allowing OS customization was a concession to get third parties to adopt Android as the de facto iOS competitor. And OEMs and carriers love to push their own customizations to build revenue streams.
It's one thing to swap out PROGMAN.EXE, as HP did with NewWave. But you're not allowed to interfere with the ability to run Windows Update.