I'm assuming it was lack of proper maintenance (which covers third-party add-ons imo) unless they present a new vulnerability or exploit to vBulletin that is. Of course we all know from the recent PSN network hacking and common sense tells us that the company does not want to own up to such as it would be detrimental, Sony did own up however recently I've read they knew about it to a certain extent and decided to protect one server over another but not trying to derail the thread simply related imo but more
here if your interested

.