I run several sites with phpbb, some high traffic, and have been happy with it.

If you watch the phpbb site & bugtraq and patch vunerabilities when they come out, you probably won't have any problems.

Additional security measures I take on my high risk sites:
IPs that admin accounts can be logged in from are hard coded.
Auto-Login is disabled for Admin accounts.
The /admin directory is password protected and set up with htaccess.
Globals are turned off.
etc.