Daryl, he is not going to browse the Internet on that server and the java installed on his server don't even has a browser plugin, i think. Security is not a big issue, if at all.. Most Java security flaws are about Oracle's browser plugin.
But Java is indeed old. I was using Openfire with 1.7.0_01 or something on Arch linux box. And when i tried to run Openfire 3.9.3 it was stalling with memory issues every day, so i had to switch back to 3.9.1. This is an option for you. Try downgrading to 3.9.1.
Though, I have moved my server to a Windows Server 2008 R2 and have installed Java JRE 1.8.0 the latest version. And now Openfire 3.9.3 runs smoothly. Not sure where the problem was. Maybe it's Java, maybe it's linux. Btw, i have modified my vmoptions to use 512-1024 MB, looks like you did it too.
After reading these forums for many years i tend to think, that it is better to use Openfire with Oracle's Java than OpenJDK. But i can't provide any facts or statistics. Just a feeling.
Btw, when you look how much memory JVM uses in the Admin Console, try refreshing it every second to see how much it climbs, because it changes dynamically. You can also check this every hour or more often to see if it actually getting close to 989 MB limit. If it does, then you are hitting some memory leak. Also you may be getting "out of memory" errors in the logs.