I'm going to sound boring here as I've mentioned this many times before, but still, it's pertinent to this thread so I'll say it again.

One significant difference is that Mer uses outdated, unmaintained and possibly vulnerable GPLv2 packages to allow vendors to Tivoise their devices.

Yocto provides recent, maintained GPLv3 packages for those that care about security, but they also provide unmaintained GPLv2 packages for those vendors that prefer Tivoisation to security.