I agree with you in a way. I haven’t studied the security flaws for the different CMSs much, I’m mainly a C/Java coder, but the “base” (sql and php) is quite secure. A good starting point is to write a DBHandler and debug it hard.
But you really need to seperate phpBB from what I’m talking about. I’m talking about a Content Management System, you might be talking about a Community System? A Content Management System is trivial to secure, a Community System is not.