Well.... the legality of using AOSP might be in the realm of possibility (granted you get a written agreement with google...which is probably a big leap) ... according to android's site's terms of service
Android.com
Under Section 8. Content in the Services
8.2 You should be aware that Content presented to you as part of the Services, including but not limited to advertisements in the Services and sponsored Content within the Services may be protected by intellectual property rights which are owned by the sponsors or advertisers who provide that Content to Google (or by other persons or companies on their behalf).
You may not modify, rent, lease, loan, sell, distribute or create derivative works based on this Content (either in whole or in part) unless you have been specifically told that you may do so by Google or by the owners of that Content, in a separate agreement.
Not helping, 10. License from Google
10.2 You may not (and you may not permit anyone else to) copy, modify, create a derivative work of, reverse engineer, decompile or otherwise attempt to extract the source code of the Software or any part thereof, unless this is expressly permitted or required by law, or unless you have been specifically told that you may do so by Google, in writing.
Which that being said could put roms against google's terms of service (unless you have some deal with google that you can distribute your roms). Google might be too big to care about someone modding code and redistributing it, but selling the code could peek their interest.