phpbb2 has quite a history of security vulnerabilities due to the fact that it was poorly coded, phpbb3 looks a bit better (code wise) still it's not as trustworthy as vBulletin and IPB. Recently SMF had a sudden outbreak of security vulnerabilities, so my advice is to go with a paid commercial product if you're serious about your forum.