you can't prove a threat model. a threat model is part of what is in or out of scope.

the first thing that should happen is for VLC dev to set up a threat model, if the user base disagrees with the narrow scope of the VLC threat model they should fork.

the second thing that can then happen is that given a threat model, a user could file a bug report to complain how a certain hypothetical attack (within scope of the threat model) violates the security.

think about it this way: for all non-security bugs, would you ask users to "prove that resolving a certain bug is within scope of the project"? how can a user prove what is within the developers' scope?

I think you are making a wrong analogy here. A "threat model" in security is like a "user operation" for the feature.

So in the non-security bug world, the exchange would look like:

Bug report: the program is missing blue circle in the top right corner. Please add is ASAP.

Developer response: what would possibly be the use of this feature? Please tell me of I will close the bug.

Here is a decent developer response: https://www.beauzee.fr/2017/07/04/videolan-and-https/