I own a license of vBulletin. After approximately a year of experience with their codebase I decided that burning off my eyeballs with a hot spoon would be more fun. I wouldn't know where to start to describe just how bad their software is.

It doesn't end there. The folks who own vBulletin run a whole series of communities themselves:

http://www.internetbrands.com/

At one point into configuring vBulletin I realized they had code in there that would allow them to monitor your site's traffic and performance. Which is genius if you run hundreds of sites yourself and want "probes" out there to discover areas that you could launch sites into. And, it is even more brilliant if you can have these "probes" be people who pay you to use software you produce. Imagine thousands of business experiments actually paying you and feeding you audience data. That really didn't sit well with me and a number of people who were awake while installing and configuring their vB software. The vast majority of folks running vB communities either don't care or don't have a clue.

There are other issues. Maybe someone else has the time to chime in.

I guess my point is that password security might not be at the top of their priority list.