Xenforo overall takes security more seriously than phpBB, vBulletin, and IPB, possibly because they don't have as much legacy cruft to worry about. For instanc

Xenforo overall takes security more seriously than phpBB, vBulletin, and IPB, possibly because they don't have as much legacy cruft to worry about. For instance, vBulletin knows about (and doesn't plan to fix) a vulnerability that allows any moderator to privilege escalate to take over a server (and steal passwords) under default settings. They don't consider it a big deal because moderators should be considered trusted users. Unfortunately, it's significantly harder to ensure that every moderator won't get their password stolen than it is to ensure that every admin won't get their password stolen. Recently, @rootinabox exploited that (and possibly other vulnerabilities) to hack a bunch of Pokemon sites that were running vBulletin.