What is not clear for me is the security, so what threat is posed by an incomplete chain of trust?
Many browsers will work around such incomplete trust chain, i.e. fill in the missing intermediate certificate from other sources. This is typically done by using locally cached certificates or using the CA Issuers part of the Authority Information Access extension in the certificate to download the missing CA certificate.
But apart from the desktop browsers these workarounds are usually not done. This means that mobile applications, mobile browsers or standalone desktop applications or scripts will fail to validate the certificate which usually results in failing to access the site. In this case it would only be an availability issue. Some developers though then "fix" the problem by simply switching off certificate validation - in which case the availability problem turns into a security problem since now arbitrary certificates are accepted for the site and MITM attacks get undetected.
Server Cipher order is not set
My guess is that it means that the server will adhere to the clients preference of ciphers instead of having its own preference which ciphers are best. As long as the server only supports secure ciphers this is not a problem at all since the final cipher will still be secure. In fact, it can be perfectly ok to adhere to the clients preference. One example is where the client has no hardware backed AES implementation and thus might prefer ciphers using ChaCha20 which have efficient software-only implementations. The server might agree to this preference in order to take load from the client - see this blog from Cloudflare for more.