If he's backing up to the filesystem somewhere underneath the forum root, really all the "hacker" had to do was get the URL. Eg if his backup path is httpdocs/forums/backups/backup.sql, it's as simple as navigating to whatever.com/forums/backup/backup.sql and downloading it. The problem there isn't vBulletin, it's just bad admin policy.

Useless side trivia: This was a big deal on MS servers, because in older versions of windows you could exploit the print buffer and force your way into the shell if the machine was running IIS. Would-be hackers, once in the shell, could copy whatever they'd like into the web structure and download whatever they wanted that way.