If you're happy with v1.3.9h there is no strong need to upgrade -- it is secure when properly set up. And if you don't want to deal with the changes brought on by v1.5's adherence to PCI compliance, then you really don't want to upgrade.

Also, it's possible to make the phone field non-compulsory.

Rob