They have not been reviewed to anywhere near the extent that AES and co. have been. So few people use them, which makes them less attractive targets for cryptan

They have not been reviewed to anywhere near the extent that AES and co. have been. So few people use them, which makes them less attractive targets for cryptanalysis, and so on. Also, I'm under the impression that NaCl achieves impressive speeds, but at the cost of using implementations tuned to a specific CPU. This makes the amount of code that has to be reviewed considerably larger.