I had this convo with my host and want to ask some stuff regarding it.

Depending on where you actually get your version of XF from, will determine it's credibility. Yes, there are many shady sites that will 'null' or edit already existing nulled boards, but they're pretty scarce.

Look at it this way, why would you null something, release it and know that somewhere out there on the internet, there's a board that has a backdoor you know how to access, but you have no idea which board and will never find it? It just doesn't make sense.

If you get your release from a trust worthy site / user (Nulled is a perfect example), there shouldn't be any backdoors. Now that doesn't mean there aren't security risks, any nulling of board software creates them (but practically no one is going to bother to attempt to take down your board).

To answer your question as to why people null board softwares, if there's nothing to gain- well that's not entirely true. Most people do it, because they can. Others do it, to publish and gain traffic to their website / board. Some will do it, to show it can be done or they were the first to do it (reputation among their community). It's always a competition.

As long as you make regular (daily) back-ups of your site, you shouldn't have any problems. If you're purely just running the site with absolutely no back-ups, nulled or legitimate, that's idiotic, as even a bought board software can be bruted into, regardless of security. Back your site up and use the version you have, if anything goes wrong, take the site down, upload the latest back-up, put the site back online, clone the site, fix the vulnerability, upload clone to main site. Easy as that.