Oddly enough, according to Yandex research , the share of vulnerable sites on IPB and Vbulletin is greater than on phpbb. Unfortunately, purely on the forums, they do not provide data. If you look at securitylab vulnerabilities, the situation is reversed, but they do not write about everything. Over the past year, vulnerabilities for these three have not been shown at all.
In general, the main problem is that admins:
1) are too lazy to update;
2) put all sorts of left hacks;
3) they neglect antiviruses, screw up on hosting, etc. This is no longer the case for forums.
So stay tuned, update, and don't use third-party add-ons and you'll be happy. The best defense is the brain.

Simple Machine Forum.
I've been using it for a few years now, it's great. Remembering invision - already takes aback.

I am for IPB and vBulletin. Still, they are commercial, and their code is not so open.
But according to the security branch, I think that the one in which the project administrator will be more knowledgeable will be safer. Flexible configuration + some handmade with files that, for example, can give out a version will give a fairly large increase in security. Oh, and necessary updates.

IPB or vBulletin, because cool powerful forums are built on them and admins are constantly sitting there who follow him

I am for IPB. I've been administering the forums on it for 6 years now.

If the hands are from the shoulders, then it doesn’t matter which one, they are all “with a twist”, but I like IPB more.