I might ditch vbulletin soon - I hate the annual fee and there are a couple other free forums that do just as much as vB does....and you don't have to pay a penny for them. As for security, most of the issue depends on how many dumb addons are inserted into your forum, those things have lots of exploits. Also, the security and permissions you set for your forum and its files, etc.
You don't have to pay any "annual" fee uh, your half correct with that statement in the fact that ANYTHING can be exploited. vBulletin is much more secure with the updates Vs phpbb2 Not only is vB worth it, so are many of the paid addons Simply, you get what you pay for. If you can't afford vBulletin, then it's not the script for you
Here is my take on the situation... I've messed around with forums for a while, and my latest forum runs IPB but content was lacking. I was debating switching to vB for the ease of use so I tried the demos for both at length and this was my final conclusion. Both sites have many resorces out there for skins, mods, writing your own mods, upgrades, etc. From a users point of view, vBulletin is very easy to use and has become the common ground for larger forums so users are familiar with how to use it. From an administrators point of view, vBulletin is a steamy pile of shit. IPB has a FAR better administration panel and moderator tools. Now, having said that I hate all the other IPB plugins (gallery, nexus, etc). So, what I have done is used Invisionboard, and changed my skin to look and function as much like vB as possible. The end result was happy users AND happy admins. IMO if IPB put as much time into the user interface as they ad into the admin console, they would take over vBulletins market share overnight. I would reccomend IPB over vB but either of those over the freeware like phpBB, smf, ikonboard (the root of IPB), etc.