This only happens when you download VLC from an untrusted source and one has to be really stupid (excruciatingly stupid) to download an open-source software from an untrusted source, when the official source comes first on the Google SERP.Wasn't this because somekind of Chinese spyware was using VLC installations on PC for its job? This has nothing to do with VLC itself but the spyware dll uses VLC on a compromised PC to do it's spying. So the government's solution is to prevent people from using VLC altogether. Kinda stupid solution but then again how else can they fix this mess? Run a antivirus scan on every PC in the country?
Cicada (aka the hackers) is modifying one of the VLC binaries (DLL) to add the functionality they want and then they distribute it. Software hackers/crackers have been doing this since forever. There's no security vulnerability in VLC that one should worry about.
And the retarded Indian government made it more easy for them by banning the official website. Hence, people will be more inclined to download VLC from untrusted sources now than they used to do before, thereby opening up to more hacker abuse.