It seems premature to be "freaking out a little bit" before knowing the details. This specific component might be open source and/or the same API with a different package name.
It could be, or they could push back every change into AOSP. It just seems like a very odd move to shift their networking API away from the open-source Android, even if it is for security. They probably didn't really have any other choice.