Sure there is. You’re increasing the scope of the key to include a third party, but… it’s one that controls the OS, distribution channels, publishing platform, SDK, the tools used to publish APKs, even the device drivers on your phone.

If they want to maliciously modify the VLC apk, there isn’t anything you can do to stop them.