Additionally, it's not really shared ownership that causes problems; it's the fact that references (and pointers) make it possible to violate ownership semantics.

Shared ownership makes it much harder to reason about lifetimes, increasing the chance of mistakes.

shared ownership via shared_ptr is safer than unique_ptr, from a UAF point of view.

Only if the dereferencing code holds the shared_ptr. It's also common to pass non-owning pointers to objects held by shared_ptr.

When people use the delete operator manually and mess up, do they usually delete objects too early or too late?

As you pointed out, problems arise if objects are deleted too early or twice. Double free is common in C and can be exploited as well...