For users to upload their own avatars you can't get around the 777 permission settings. I would gather the cache directory requires it as well.
phpBB is prone to attacks being one of the most popular freeware forum software packages available. All I can say is monitor when they release patches and apply them as soon as possible.
An alternative free forum software would be Simple Machines Forum (SMF) which hasn't had as much attention as phpBB but it's easier to upgrade when patches are released.