What they mean is: a Man in the middle attack is very unlikely and not easy to setup. They will not spend time on this issue untill the OP has a valid threat model. Which the OP has not given.
They already cryptographically sign and validate the updates, which is why it is ignored. It's another solution for the same problem ( reducing change of a malicious update)
PS.
> This is a security risk and should be solved ASAP. Thanks
This has a unfriendly tone of the OP. I would have done the exact same thing in the same situation as the VLC developers ( since there is already a solution implemented).
They already cryptographically sign and validate the updates, which is why it is ignored. It's another solution for the same problem ( reducing change of a malicious update)
PS.
> This is a security risk and should be solved ASAP. Thanks
This has a unfriendly tone of the OP. I would have done the exact same thing in the same situation as the VLC developers ( since there is already a solution implemented).