As far as I can tell that new forum is being developed since dawn of time. There is no information about ETA.
It has been in development for a long period of time, yes. However, the
beta of the new forum is currently live. It is not as far away as it once was.
I am not sure how hard is to update SMF but if that process is not something insanely problematic maybe forum crew shout try it?
There would be little point in doing so. Any security bugs that the new version would solve would likely be overshadowed by the amount of security holes fixed in the current version. To port these fixes over to a new version of SMF would take a lot of time and effort for very little reward.