Sure, you can fork it but your fork will never reach the same level of security as the original simply because you cannot afford to put in the same effort as Google does.
My point is that these forks are futile because it takes only one major vulnerability - found by Project Zero and publicized with Google's might - to blow you out of business.
Project Zero notifies vendors before disclosing the vulnerability. They would also be able to provide a patch from Google assuming the code hadn't diverged too much since the fork.
My point is that these forks are futile because it takes only one major vulnerability - found by Project Zero and publicized with Google's might - to blow you out of business.