such as the GUI installer pamac allowing unsuspecting users to trivially install unvetted packages from the AUR without even a clear indication they may be dangerous
Unless something has changed since the last time I used Manjaro, this isn’t actually true. You have to go relatively deep into Pamac’s settings menu to enable AUR packages, and when you do, a popup comes up telling you what the AUR is and why it might be dangerous (although iirc, it neglects to tell you that an extra reason is Manjaro packages being out of date).
Not that I’m pro-Manjaro, for all the other reasons you’ve given.