Offensive rating increases from 1 to 4.

First of all, you have a +3 sword. That means +3 attack bonus and +3 damage. Replacing the morningstar with a Vorpal longsword carries the attack bonus from +4 to +7 and the damage from 11 to 14.

Mathematically, the beheading is worth at most two points of damage. When considering tier one PCs, they usually won't have a lot more than 40 hit points (at most 49 for a 4th level barbarian with Con +4). The average tier one character (if there is such a thing) probably has less, but let's assume that the odd crit kills a healthy 40 hit point character. This is worth 40 damage, or 2 points of damage per attack since the odds are one in twenty. Multiattack and advantage would change the odds but the bugbear does not have those.

So, the final damage output would be 16 (CR 2) increased to CR 4 (attack bonus +7 instead of +3).

By the book, the final CR would still be 1 (4 and 1/4) but that is because at CR below one, the monster creation table allows for many more hit points than the MM monsters usually have at that CR.

The monster is skewed and the standard deviation problematic

The offensive CR is much higher than the defensive CR. This means that the monster will easily kill someone if the initiative and attack / damage rolls go right (wrong from the players' perspective). This, however, is mostly due to the +3 and not the beheading.

The other problem is the standard deviation (your monster is now very swingy). Every natural 20 will kill a PC. Probably this will not come up: The chances are slim and the monster can even be restrained / disarmed etc. as NathanS stated in their answer. If it does happen, somebody dies. Now, the random critical hit killing a poor first level character is nothing new. However, the Vorpal sword significantly aggravates the problem because:

• a critical hit does not often kill a level 1 character, but always

• the principle got extended to later levels

You cannot reasonably consider that large a deviation in CR. If you increase the CR (the number, not what it means) and no one gets beheaded, the monster will seem underwhelming. If you take a low CR and someone dies it will seem like the monster was too dangerous. However, if the players know the dangers and can take countermeasures, it doesn't need to come to that, see NathanS's answer. The principle is the same as with a Will-o'-wisp, which will also kill a PC if you let them lie around unconscious.

Magic weapons should not affect an individual creature's CR, but they should affect the difficulty of the encounter

My reasoning behind this is that magical weapons can be nullified fairly easily. A low level party would be able to nullify the Vorpal Sword by:

• The command spell (available to 1st level clerics and 2nd level paladins) can be used to make the Bugbear drop the weapon, assuming they fail their saving throw.
• Using spells like sleep (available to 1st level full casters) to put the bugbear to sleep (assuming they roll high enough on the 5d8) will allow anyone to easily take the sword from them before they wake up.
• Using spells like hold person (available to 3rd level full casters) to paralyze the bugbear may also allow anyone to take their weapon away; ok, the bugbear might pass the save, but the Vorpal Sword isn't going to make that any easier for the bugbear to achieve.
• The fear spell (available to 5th level full casters) can make creatures drop their weapons; again, the bugbear has to fail that save, but again, the sword isn't helping with that.
• A lucky Divination wizard (so 2nd level minimum) could make the bugbear miss its attack by using Portant to force it to roll low, allowing another round for the party to put that enemy down (potentially two rounds if they have two low rolls for Portant).
• A Battle Master fighter (so 3rd level minimum) would be able to disarm the creature, then pick up the weapon; now that bugbear is just a regular bugbear, possibly without any weapons at all.
• If using the optional rules for disarming (DMG, p. 271), then any character can attempt to disarm the bugbear and take the weapon.

Of course, should all of these attempts fail, then the bugbear is going to hit hard, but I'd call that a difficult encounter (since there's now a potentially lethal weapon floating around in the hands of the enemy) rather than a difficult creature, since the bugbear is just a regular CR 1 bugbear without that sword (for example, passing it to another bugbear). If the tables turn in that encounter, and the party end up with that weapon (or at least that the enemy somehow lose it), then those creatures aren't any different, but the encounter now is.

Also bear in mind that you're then giving the party a Vorpal Sword if they win that encounter.