AOSP maintain their apps in regards to security issues or bugs.

Even Messages, which they say isn't actively supported and may be removed:

https://android.googlesource.com/platform/packages/apps/Messaging/+log

The features, however, are lacking - they mainly serve as reference implementations with just the core features. This is a big reason why GrapheneOS maintains forks or replaces the apps entirely (like the Camera). It would be best to replace more in the future.