You can provide all the Source and make it impossible for the user to install their own firmware. Archos, Motorola, Netgear, Dlink, Linksys and many others have been doing this for years.
Many many set-boxes and DVD players run Linux and may not have any "obvious" way to update the firmware, and if they do (serial port, On the Air, special format ISO) you usually can't install your own version. Even if you can, usually it's pointless or becomes pointless as the product becomes older.
Early adopters are Pioneers. Get arrows in Back.
GPL is a red herring as is Android being "open source" at all.
Also you can have a Binary with the distribution for the Radio part. Most DSP/Radio/RF/GSM/3G stack software is proprietary, not GPL and not Open. The Linux will communicate with that via an API or in some cases to a co-processor via I2C, parallel buffer, "serial" or even ethernet in some embedded products. There is no requirement for the whole system to be open. Android itself is a Java VM like VM running Java like "byte code".
People be better to think of Android Handsets as legally and practically more closed than Windows Mobile and more locked than iPhone. Please take no notice of the Android Source being open. The phones are not, nor intended to be.
I think in future it will be harder to apply anything other than vendor updates to an Android phone and harder to install any app not from an authorised App store.
The early Android phones are now obsolete. In many cases even if the vendor did work at producing an update (why would they?) the experience will be poor or parts not work.
No Doubt Android 3.x will orphan more Android handsets.