They’ve had many security blunders that are a result of nothing but incompetence.
They’ve negatively affected the entire arch userbase (not just manjaro) multiple times when their bugs caused the entire AUR to be ddos’d (multiple times all from a similar issue)
They regularly forget to do simple security/maintenance practices like renew SSL certificates (which are able to be automated with let’s encrypt so there is absolutely no excuse for this happening this day and age) - in which they instructed users to “set their clocks back” to temporarily “fix” it
Not a single mention of the thing can go without one of you rushing to your keyboard to recite your mantra, I've seen less proselytism at a protestant gathering than when Manjaro is even vaguely peeked in a screenshot, you don't even care what they did bad you just run on the bandwagon to feel like you're part of a movement, you read somewhere they "DdOSseD ThE AuR" and fucked up with certs then run with that when those same people tried to push a Closed source Office suite in their iso's in full conscience, but you don't care about that since you didn't spend a single second actually asking yourself why you hate it, you just look for validation picking up whatever new hate trend you saw online.