InfoWorld has a cover
story on whether VoIP is ready for prime-time.  It’s comprehensive,
and I highly recommend it for anyone considering such a move. 

Among other topics discussed is, especially for law firms, the
all-important issue of security.  For example, did you know
there’s a "readily available" Unix tool called "Voice Over Misconfigured
Internet Telphones (also known as VOMIT)"?  Forward your
managing partner’s calls to your competitors?  Check his/her
voicemails?  It’s all possible.

So why would any firm in its right mind do this?

1. The conventional PBX system is not as secure as you assume, and
   there’s an historical track record of being able to hack into it
   (in other words, don’t assume that the devil you know is preferable);
   and
2. Cisco and the other big players in this space are not naive;
   they have "hardened" versions of VoIP operating systems, up to
   and including intrusion detection.

The bottom line:  If you implement VoIP assiduously, you could
increase the reliability of your network overall.  And face
facts:  That day will come.