I believe both devs and users should have the liberty to discuss and propose threat models, but if there already is "some level of precaution" the real question is where was the previous threat model that dictates signing? or is this security theater?
the first thing that should happen is for VLC dev to set up a threat model, if the user base disagrees with the narrow scope of the VLC threat model they should fork.
the second thing that can then happen is that given a threat model, a user could file a bug report to complain how a certain hypothetical attack (within scope of the threat model) violates the security.
think about it this way: for all non-security bugs, would you ask users to "prove that resolving a certain bug is within scope of the project"? how can a user prove what is within the developers' scope?
So in the non-security bug world, the exchange would look like:
Bug report: the program is missing blue circle in the top right corner. Please add is ASAP.
Developer response: what would possibly be the use of this feature? Please tell me of I will close the bug.
If the attackers can do a MITM, they probably also have other stuff at their disposal :)
But more important, issue the bug with a valid threat model and it could be fixed. As long as there is no threat model and perhaps an active discussion ( this is how open source works), the ticket stays closed.
The OP had 2,5 days to respond.