absolutely, thank you for asking

Manjaro has been continuously destructivte to the open source ecosystem it utilizes and it's users through continual incompetence.

Manjaro and it's staff often suggested to users that they use "pacman -Syyu" by default to update, which ignores caching to get a reloaded database. This puts a heavier load on the volunteers hosting the repos.

Manjaro made a campaign stating that "Manjaro works on the m1 apple macbook!" Shipping a random kernal from asahi linux which did not work at all. The project was nowhere near ready at the time and could never boot. This wasn't the latest build either, just some random build. This build could have easily broken users macbooks.

Back to the asahi, when it did work they pushed an update to the kernal that broke half the users gui. This by updating a library which was documented to break in this manner. It broke all x11 instances showing they didn't even run it to ensure it worked. No benefit existed from updating either more was it stated to be the goal of their patch. The reason it wasn't checked by the devs is due to the fact the patch came from the lead arm dev of manjaro. This man should know better.

On the funding of manjaro, a company, things have been a little funky. After a spat between their treasurer and leader of the project the treasurer either left or was removed. Now, what happened is blurry, but now the sole person in charge of money is that leader who has never appointed a new treasurer as they stated they would. Atleast since last I checked. If the previous treasurer is right this person was utilizing development funds to acquire a powerful gaming laptop. Something which is directly against the stated purposes this company may use money, and the responsibility of a treasurer to deny.

They let their ssl run out 5 times. 5 times. I am a web dev, this shouldn't happen once. One can automatically renew it. This shows their continual incompetence. The first time, they suggested users set back their clocks so it would stop complaining.

Manjaro ddosed the aur twice using their tool pamac. Both in the same manner showing once it had happened nothing changed to ensure it couldn't twice. This was not malice of course, just an mistake twice made.

Back to the aur, though many will never have an issue as they only use it for general programs they don't hold it back that two week period so version mismatches can break that which is installed from the aur.

Still on the aur, the ability to enable it is right next to flat packs and snaps in pamac. Both are relatively safe, unlike the aur. They do not properly warn users about the aur. I'll admit this to be a lesser thing, but anyone using the aur should know it's faults. It's just a list of scripts which your pc will run to install a package that'll auto update to the next version of a script when updating. This means, basically anything can be put inside there. By design too this is rarely maintained by the devs of a project. One issue which came up, the cemu emulator a very commonly used package had to calls to an IP logger alongside a list of people who can "go fuck themselves". If you let this update without reading it you can recieve malicious updates. When malware exists and propagates on linux the aur is the first place it'll go. You need to be able to read the scripts and do so each update . The air is a very useful tool but a dangerous one.

There's more out there but I'm going to leave it here. Sorry for the rambling nature, but I' a bit tired right now