They're also pretty behind on major OS updates and even bug fixes last I've checked. The software story was very disappointing when I wanted to get one.
- Old kernel versions with many known CVEs (applies to both stock an /e/OS).
- Old firmware bundles with many known CVEs (applies to both stock an /e/OS).
- Old major Android version, so missing fixes for vulnerabilities not marked high/critical (applies to both stock an /e/OS).
- Chinese firmware blobs, TCL image processing firmware (applies to both stock an /e/OS).
- When using the App Lounge, F-Droid installs go through a proxy (CleanAPK), that Murena does not want to reveal the purpose or owner of. Given Android's trust on first use policy, this could be used to intercept installs and install malicious packages. (/e/OS)
- Runs microG privileged. When an app does Google Play Integrity checks, Google's obfuscated DroidGuard blobs run privileged (/e/OS).
- Runs many Google apps (e.g. Google Maps) with higher privileges (/e/OS).