Does anyone contribute to AOSP besides Google? Does Google actually accept any patches into "upstream" and ultimately into their own commercial distro?

The phrasing of your first question is ironic given GrapheneOS has upstreamed a ton of their security hardening.

You're probably asking if they're able contribute anymore?

quite a few manufacturers do, specifically in the automotive sphere and ofc samsung etc.

in terms of accepting, unless it's stuff like bugfixes to core mechanisms, not really.