shnepo
I know I am not the one you asked nor do I have any source.
I am also unsure about Fairphone's misdeeds I do not keep up on them.
Murena on the other hand I am very aware of. Even used one of their phones in the past. Pretty big mistake. The company is definitely worthy of scrutiny.
Most of the evidence of their misdeeds can simply be found on their official forum (not sure if I am allowed to link to the site) and have attacked projects that have legitimately tried to improve privacy and security on Android. The ones I remembered mostly are GrapheneOS and DivestOS when it was around.
My main problem with Murena is that they aren't honest about their OS nor their Products. If they were honest about the insecurities of their products I wouldn't care nearly as much. But they aren't.
Some cases I remember currently are
They once had a incident where they mishandled session keys and gave users access to other’s files and then proceeded to gaslight their userbase that the server could not see nor access their files.
Also a bit of a extra thing this isn't security related perse but their server infrastructure had a critical failure in its storage devices that caused users to lose access to some data for pretty much close to over a year if not longer. This is not a sign of a competent company at all.... And they also made zero effort to actually make users aware of this outside of the Forum which is very problematic as there are probably a good amount of people that don't even use the Forum.
They have attacked the mentioned projects (probably more than just those two) and downplayed security as a whole aswell
I remember recently when their /e/OS + Fairphone combo got exposed by GrapheneOS they made a whole post on their forum full of crap downplaying things like the Secure Element saying if you are worried about that just use a long 25-30 character password. Why that is very downplaying is that most users are not going to use a long password. Hence why the Secure Element actually is VERY important. They also downplay the importance of Verified Boot on their Official website. Though at least there they are honest that the lack of AVB is a genuine security risk even If they do downplay that risk.
I also remember a long time ago they downplayed the importance of Operating Systems like GrapheneOS and DivestOS as a whole and basically said you'd just be better off going without a phone if you're that paranoid. And maybe they are right in a way but for one that is disrespectful on many levels and two that is completely downplaying of the point of why these Operating Systems exist. To better protect users who are forced to use smartphones. Which is basically a majority of the global population nowadays... Also recently they made a fairly interesting quote which was "Which has more security your home or a prison? Which has more privacy your home or a prison?" Which again this is extremely downplaying of the importance of security and also like every single one of their excuses trying to shift responsibility and accountability away from them.
I swear if I hear them mention "state of the art security" one more time.. I don't even know but they make that term somehow sound incredibly stupid.
Mind you the original post where they downplayed security was people asking for the webview to be updated which was a year behind in updates.
I hope this helps you understand just how bad they are and apologies for not being able to link a source as I do not know if that's okay or not. But all of this information I mentioned can be validated and confirmed on their official sites including especially their forum you just gotta search a bit for it considering a lot of the mentions I made can span time from a few months to years back.