Hmmm - I am not really sure how to answer this question GSeybold. I know that generally there will be patches provided by vBulletin as long as the version is still supported. But yes - if you decide to keep a version which is no longer officially supported - it becomes your responsibility to make sure there are no security issues and that all exploits are patched/fixed. The interesting thing is that there is the larger online community that exists, like
www.milw0rm.com for example. So - whenever an exploit is found - it's generally reported. And the word spreads quickly.
I'm not familiar with the procedure used for any outdated vBulletin versions personally - perhaps someone else may be. But generally whenever an exploit is found - a patch might be developed... I would assume that any exploits found in outdated vBulletin versions may be remedied by members of the larger online community and freely shared (or sold) throughout the vB community.
I do know that there are boards still running unsupported versions of vB just fine - even the ancient vBLite LOL - I think
WinAmp Forums is still running a modified version of vB 2.0
So - all of that was a really long-winded way of saying "I don't know"
Jacquii.