but given the risk, it's safer to take the VC money.I agree that the risk exists, but I don't necessarily by that it's a fait accompli that taking VC money is the safer route. Consider that taking VC money comes with it's own risks, including:
1. VC's who think of themselves as "smart money" and want to be actively involved in running the company, and wind up muddling the vision and taking the company in non-productive directions.
2. The need to adhere to artificial timelines w/r/t spending, fund-raising rounds, etc. which are inherent in the VC model for structural reasons (funds are time-boxed, etc)
3. Taking VC money acts as validation of the idea on a much broader scale, prompting even more competitors to enter the market
and so on.
Keep in mind, as another commenter mentioned, if you stay private, focus on talking directly to your customers, don't get caught up in the "attract massive attention to yourself at all costs" cycle, and fly under the radar, you can most likely get yourself pretty well entrenched before this hypothetical "idea thief" even becomes aware you exist.
I'd also argue that most people - especially the actually talented ones - aren't just sitting out there waiting to steal someone else's idea. If they're talented enough to execute your idea, they most likely have plenty of ideas of their own. That's not to say that "idea thievery" never happens, but I think this notion is over-stated. YMMV, of course.