This is a difficult topic since there are so many individual things to consider.

kingoo is right with the point that there is no open source baseband available, so there can't be a true, complete "open source" device. This has more to do with the monopoly of qualcom than with mobile network security, if you ask me. But in the end, your device has an interface to a closed source, rarely updated, known to have bugs operation system on the baseband unit, reachable over the air.

Now for SFOS, which from my understanding went further away from the open source idea with moving to the Sony Open Device Program. On the Sony devices, SFOS uses the bootloader and Android kernel provided with the device (which prevents Jolla from fixing certain bugs on the Xperia X, as they would have to migrate to the new kernel v4, provided by Sony). While the kernel can still be counted as open source (because it's a Linux kernel), it's making the whole handling much more difficult because it is no longer in the hands of Jolla to modify it.

Still, I personally prefer SFOS over Android any time. Open Source simply means that you can review the source code, not that this code is "good" in any way. With Android, my issue is less the closed source part of the Google Apps, but the whole ecosystem of Google with the goal of collecting as many data as possible. And this is present as well in the AOSP systems (regular "internet connection checks" to Google servers, default synchonization of all data, ...). Using an Android system always makes me paranoid that all and everything wants to grab my data. And while you can manage that for Apps quite well by now, you can't really restrict the core system (at least not without a big effort).
So the point "better having closed-source apps which you can replace easily than closed-source UI which you can't" isn't valid when you can't trust the company behind the whole system.