They should really consider upgrading to SMF 2.0.4, because this version will not be supported in the coming months and it will not be receiving any more security updates after that time.
Maybe the fear of a future unpatched security hole will make the SMF upgrade climb up the priority list 