These criticisms exist because Samsung does not offer first-party solutions to things such as malware detection, location sharing, storage management, caller ID, VPN, music streaming, and news aggregation. It's unclear how exactly these services are being used (Samsung should be more clear on this front) and what parts of it are integrated (Samsung should be more clear here as well).
But, well, put it this way. If Google or Apple had offered first-party solutions to each of those services, would they be criticized for offering bloatware as well? No, probably not. So, is the issue here that the services aren't first-party (Spotify) or that they aren't from traditionally trustworthy sources (McAfee)? If it's the former, why does it matter? If it's the latter, then Samsung should be more clear about the extent of the influence of the other company, which they are not, but that shouldn't necessarily exclude them from collaborating.
Now, there are some key issues that should be criticized. Hard. A persistent notification? It's unforgivable. Facebook? The amount of tracking they can do makes them a threat to the device. It's basically spyware. It can be disabled, sure, but it shouldn't be enabled in the first place (except to enable Gear VR, I guess).
But really, can you trust any major tech company, considering programs like PRISM exist and are in operation? What differentiates Google from Apple when the device is still able to transmit whatever it wants to whoever it wants however it wants? Apple or Google may or may not be tracking some piece of data, but that doesn't necessarily mean that it isn't being collected and tracked by someone. That the companies themselves don't happen to store the data that happens to be the very thing they make their money protecting and using? It's definitely better in that your data isn't being used for the company's profit, but is it really any better for privacy from, say, the government?