“Absolutely not” Xenforo is one of the most secure forum softwares released to date (that’s written in PHP). Check their announcements section on their forum to see what vulnerabilities have been patched.
Loads of money? So $140 is loads of money?
“annoying javascript popups” What Xenforo forums have you been visiting? Default install doesn’t have that.
“just a whole lot of bloat on it” What I said above.
“MyBB as I said is free and it has a lot of good plugins for it as well.” Xenforo has plugins that are ‘good’.
“I think it might also work a bit faster but I don’t know for sure” I doubt it.
Xenforo hasn’t had many vulnerabilities like MyBB has.
Free isn’t always the best choice.
I’m not saying MyBB is a bad software (I do like the software myself), but for a company it is.