there's a difference between 'what the license allows' and 'best practice'. To anyone involved in 'traditional' F/OSS development, stuff like an SCM with the latest development code, an open bug tracker with actual developer involvement (unlike android's, which mostly functions as a black hole), and open mailing lists are pretty much part of 'the system'. A project like Android (2.x, excluding gapps), which does code dumps and rarely accepts outside contributions, is free in terms of licensing, sure, but it doesn't function anything at all like a more conventional F/OSS project.
Is there a legal problem? No. Everything's perfectly above board. But it's not really an open project in several practical senses. You can fork Android, but you can't really contribute anything back to it, or follow current development.
In the long term, of course, this is *bad* for Android, and Google will realize this at some point. It's a major reason why every Android hardware developer tends to maintain its own fork of Android with support for its own particular hardware implementations - a very wasteful practice. CodeAurora is an initial response to this, and I wouldn't be surprised if Android starts taking baby steps towards more conventional open development practices in future.