VNC is not malware. It simply should not be installed as part of a security package, or at least users should be warned of the risks and told the default option is to not install.