The weakness in Manjaro is that you either risk using the AUR or stay on old versions of the software.

That is part of it yes. But Manjaro has so many other things specially new users will not expect and know how to fix, It is not a great starting point as they claim it is. From DDOS'ing the AUR to forcing users to rollback time because they let ssl certificates expire. their are many things they dont do right and for new users this can be a major turn of when they are hit with these issues. for a distro aiming to be arch but user friendly. And the user doesn't have to do anything weird for these things to happen just use your system as you would no AUR and update and break the system. this has happened so often with Manjaro that i would steer away from it unless you know how to manually fix those breakages. but at that point just use arch.