My understanding is that if you only add modules on top, those can stay closed source. It's possible the AOSP portion of the stack is still stock and untouched.
I don't know, one of the reasons they're decrying everyone running the APK is they claim they've made a bunch of "bespoke alterations" to the AOSP version they're using
AOSP is fully Apache-2.0 licensed except for the Linux kernel, so only their kernel changes would have to be. It's also an important reason why Android was/is so successful.
Depends on which part is altered. Lots of Linux distros are just curated collections of software, drivers, and configuration. You can easily achieve your OS goals without touching the code of the base distro at all. If they didn't need to modify the base code then there's nothing to distribute back. That would be like distributing your personal OS power user config settings. If you're not touching source there's nothing to contribute.
Having seen what this device does, they may not even have had to alter anything to the base AOSP image. Just set your app as the launcher and you're good to go.