I am so confused, and never quite understood the mechanic.

an item with 210ed (unique as an example) can roll 2100 defense
but an item with 190ed can roll 2400 defense.

how does ED and defense work for rolling, and can you assuming defense range any good explanations?

The base defense is re-rolled too when you upgrade.

so does ed, mean higher base defence of the unique?
or is it random

The base defense is rolled randomly within the range of the "base item" once it's upgraded. Dropped items that have a +ED% will automatically roll the maximum base defense + 1, which is not the case for items upgraded with the cube.

each armor item has a certain base defense range, for example a Grim Helm can roll any defense number in the range 60-125. if you upgrade it into a Bone Visage, this base defense is rerolled, range for Bone Visage is 100-157. So if you are unlucky, you may find a rare Grim Helm with 120 defense, upgrade it and end up with Bone Visage that only has 110 defense.
to make this worse: items with +X% ed mod always spawn with a base defense of (max base defense +1), but this base defense is rerolled randomly after upgrading. so assume a grim helm with +100% ed: base defense is 125+1=126, total defense 252. upgrading can lead to Bone Visages with base def 100-157 (which means total def 200-304).
long story short: if the base defense ranges overlap for non-upped and upped item, there is a possibility that you lose defense by upgrading