The bad stuff: Poor documentation on the Ubuntu-specific customizations; it's too hard to find out what's in it before downloading it. Bleeding-edge package versions are scary for servers, and I question the effectiveness of putting something like AppArmor on a system that is already security-questionable. LAMP security is famously difficult even with conservative package choices and careful attention to security patching. Quality control seems in need of some quality control.

Regarding expectations, I expect that with the funding, resources, and commercial aspirations behind Ubuntu, it should be a marvel of quality, security and stability, and with the awesomest documentation of all. Debian succeeds at all of these with hardly any funding. Debian and Fedora both show how release notes should be done.