Are there security vunerabilites/implications with SQL Mail, currently using SQL Server 2008 R2
Please use Database Mail instead of SQL Mail.  SQL Mail had security issues on several layers and in SQL 2005 SP2 had 'inbound emails' removed.  They then further removed support for it and it is now in the depreciation list.  

Database Mail is the solution you are looking for.  It passes audits easily, has lots of documentation, and is fully supported by MS.

Don't use this one:

EXEC sp_configure 'SQL Mail XPs', 1
GO
RECONFIGURE
GO


Do use this one:

sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'Database Mail XPs', 1;
GO
RECONFIGURE
GO


Configuration Wizard Link To Help You Configure It.

To start the Database Mail Configuration Wizard
From Object Explorer, connect to an instance of SQL Server.

Expand Management, 

right-click Database Mail, 

and select Configure Database Mail.

Choose the Set up Database Mail option to set up Database Mail for the first time.

Choose one of the other options for specific maintenance tasks:

Manage Database Mail accounts and profiles.

Manage profile security.

View or change system parameters.