Theymos wants the new forum software tested for security flaws. I think this is the primary hold up.
This shouldn't take 9 years...
I am not entirely sure, but it is possible that theymos does not have the resources to test for security flaws, meaning he does not know who he can ask to test the forum software for security issues.
There is (or at least was) a lot of business conducted via the forum, and as such, the forum is a big security target, if there are available exploits, they will be tried on the forum, while a forum in which people talk about football might have multiple glaring security flaws, and no one will care to exploit them as there wouldn't be anything to gain from doing so.
This forum is kind of like a Bitcoin Museum that was built by Satoshi, and we should leave it that way (I realize its already different from the first iteration)...
The forum uses SMF software. Satoshi likely did little more than install the SMF software on the forum server, and possibly changed some configurations. Satoshi did not create SMF (most likely), and there are thousands of other forums that also run on SMF software.
The majority of modifications to the forum software were done by theymos, or someone hired by theymos.