One big change was VLC switching to use mplayer's libass rather than their own (buggy, quite likely to the extent of allowing remote code execution) ass parser. These days VLC mostly seems alright, though it'll take a while for it to gain my trust.