I have quite a few clients running 3.x sites, nearly all 3.8.7 PL2 however at some point the vBulleitn 3 series will reach EOL i.e.
End of Life and that my friend is when security will become a issue... there won't be patches released and as new exploits/vulnerabilities are discovered they will not be patched. Is that soon or not? I'm not 100% sure when the exact date will be, none of us are but imo it will be sooner rather than later. So with that said... run 3.8.7 PL2 for now and prepare yourself for upgrading to vBulletin 4.x sometime soon and you should be good to go

.