Linux is GPLv2 rather than GPLv3 so vendors don't need to allow replacing the software. They only need to provide the kernel sources to their users.
For example, it's entirely up to phone vendors to support unlocking the bootloader and optionally verified boot with a custom key.