How long did it take for you to learn how to make a website?

ABSOLUTELY. Insecure php applications usually fall into the PEBKAC category... or poor maintennance on the back end. Updating the software as vulnerabilites are found applies not just to the php application, but php itself.

Additionally a lot of 'older' programs were just badly thought out in the first place - look at phpBB for example. With version 3 they had to chuck whole sections of the old code - it's still nowhere NEAR as secure as vBulletin or SMF, but they are FINALLY showing some progress in that area.