[Elite Hacker 69]

Might be a weird question to understand

What I mean is, can one website using XenForo (or MyBB, or ipBB, whatever) have a shit ton of security vulnerabilities while another one has none?

[DOSH]

Yes it does it depends how they edit it and witch plugins they install.

[SIM-209986]

The core installation should be the same.
All about the user edits.

But don't forget the web server part.

[Zabuza]

Yes, it can. It is completely dependent on what the user does with the site. If they don't do much with it, it will usually be fine. When they start to go into more customization and custom plugins then possible security issues can be presented.