From the research I did, Synology was better software wise but QNAP was better hardware wise. Like @Ish Gibor said both have their fans. Vulnerabilities exist on both and whichever vendor you chose, you should be putting it behind a firewall. The key is understanding your needs are and then ranking them in order of importance to decide what solution works best for you.
That's just one way of entry. There have been many vulnerabilities on both sides utilizing different attack vectors. Like I said regardless of which vendor you pick, you should be placing the device(any public facing device) behind a firewall for your own safety.
What are some of these issues that people tend to run into?
Issues can vary. @Sonny Bonds posted about one right before this post. The best way I can explain it is that when you buy a commercial NAS(QNAP/Synology) is that you get access to support who know the exact software and hardware you are working with. When you build your own, you do not have that which means that you may spend countless hours trying to find a solution to an issue you are facing. Hope that explains what I mean.
I solved the issue I posted above, but it was annoying and I needed to go to multiple sources and then cobble the solution together from what I learned.
Yea that was perfect. I pick up what you're putting down