People will continue to use it, because it's the only thing on the block at the moment. It's features - at least in comparison to other board scripts - outweigh the ugliness of the code. I don't think most admins care that much about the source code anyway. For them, either it works or it doesn't.

I don't know what the big deal is. Security vulnerabilities come and go. I think it's more so a question of how quickly they're dealt with than it is whether or not they exist. I mean look up historical vulnerabilities for popular, expensive, commercial software like vBulletin and see how many different ways there have been to pwn it throughout time. Of course, they were remedied, but they should have been, because that shit costs a lot of money.