OK let's clarify a few things, this is where a lot of these scare stories come from.
1. Anything over the internet has no QoS, be it voice, video, chat, whatever, even over a VPN. As soon as it's out of your own network, it's out of your control.
2. SIP / RTP is EASY to listen in on calls, so long as you have either PHYSICAL access to the phone or sever, BEFORE it hit's the switch, or if it leaves a trunk port, or have access to port mirror on the switch or have access to the phone system. in this case, it's pretty much the same as an analogue line. HOWEVER if running SIPS + SRTP, it is massively more difficult to listen in on calls than a traditional PSTN. So this is simple case of it's as secure as you make it. Lock your cab's, keep admins to a minimal and make sure you audit regualry, no different a traditional system. 911 is a good point, due to the fact a phone can be in one location and break out in another. LLDP-MED + carrier policies can sort this out, by sending the correct details. HOWEVER IP phones are powered, so unless on a UPS, forget it.
To sum up, you can make a IP based phone system better in pretty much every way than a traditional PBX, but if you start cutting corners and use the race to the bottom mentality, then it WILL bite you in the ass.
Big phone systems are NOTHING like they used to be, they are now communication platforms, email, chat, IM, Video, social media, now all run through the "PBX" and this will trickle down. The trick for the old guys is to stand their ground, but accept the new world order. There will be standard pbx's for a long time, but they are a dying breed.
Robert Wilensky:
We've all heard that a million monkeys banging on a million typewriters will eventually reproduce the entire works of Shakespeare. Now, thanks to the Internet, we know this is not true.
