2 of them are essentially community run, and could theoretically at any time be taken over by a hostile (or even just an incompetant) entity and be used to distribute malware. Not that this couldn't happen through an official channel, but it's certainly far less likely.

Since the software distribution is not even, I currently have to check choco, scoop and winget for updates. It's slow and irritating, and if I need to uninstall or check a package, I need to figure out which tool I installed it with.

The software that does crossover between package managers can cause compatability issues. Just today I accidentally broke Rider since I had the .NET Core runtime installed through choco, but the .NET Core SDK installed through scoop.

I get they're trying to finally fix this through WinGet, but I can't help feel it's too little, too late.