Before I respond to the above questions, who am I: I'm a user of phpBB but not a phpBB developer nor contributor. I am however developing with symfony since about two years for web-based software. So the purpose of my post is to give some information about Symfony. I'm very pleased to see phpBB devs seriously considering Symfony 2 for their next majors version; however I am not the sort of guy that tries to urge you to actually do so.
1. Security - Security is a big issue, we don't want more security problems in 4.x than 3.x.
While I don't know in detail the specific security issues experienced in phpBB versions up to now, I can say that Symfony has implemented a comprehensive security-aware construction in many ways, and that the needed functionalities are included while not bothering you directly in your task to develop your application. Just two examples which do not need really much ado by the developer (you may still care more about it according to your situation): user authentication and credentials on modules and actions level, detailed parameter filtering and checking in form submissions, and much more. As this is a critical part you may need to get more sophisticated support by the Symfony core team on that. But I feel confident about Symfony's reliance on this respect.
2. Complexity - If the code is too difficult to follow for existing mod authors it will make it more difficult for them to develop plugins. Many mod authors are not professional php developers or have the time or patience required to learn a framework.
First of all phpBB devs are free to choose whatever plugin API they wish to offer; be it Symfony's bundle (= name used for plugins in Symfony2) or a custom API, or something in-between. I would assume you will in any case provide a custom API specialised on forum aspects, no matter which frameworks and/or libraries phpBB4 will be based on.
Even if Symfony2's bundle system shall be the platform for phpBB4 plugins, one could argue whether this be an advantage or disadvantage, considering the growing base of Symfony developers (350 paying attendees were in Paris this week...).
It's correct that developing with Symfony requires sound programming knowledge and the use of advanced programming concepts. E.g. having heard about OOP is not enough. But I think programming excellence is needed for serious development of complex and robust software products like phpBB, anyway. Especially when thinking about security problems that reportedly appeared repeatedly in phpBB3 (if I didn't misunderstand).
3. Updates - What are the plans for keeping boards updated with framework updates? What about support from boards running newer or older versions of a framework?
There is as such no requirement to always migrate phpBB along with the latest Symfony version. Symfony declares their support time for each version regarding fixing bugs etc, it's one year as a minimum, and 3 years for so-called LTS (long-term support) versions. So whenever security issues are detected in a (previously released) Symfony version, they will be fixed without compromising compatibility. This reduces the "pressure" to make migrations to newer Symfony versions. Automated tools are also provided to assist in upgrading from one version to another.
For how such support declarations and possible migrations paths do look like in Symfony, see http://www.symfony-project.org/installation
Hope this helps a bit for your evaluation.