The version is checked to avoid downgrade attacks (good)
The signature use an old 1024 bit DSA key, never renewed (bad)
We can conclude:
This mechanism is not at the sate of the art because of a deprecated signing algorithm, but the overall design is sound.
Since DSA 1024 has not yet been broken, it is still safe, but it might not be in 10 years. The lifespan of a VLC installation without update is far shorter than that, so an exploitation of this weakness is very extremely unlikely.
In summary: VLC updates are safe for now, but the update mechanism should be upgraded to a state of the art algorithm, which does not necessitate HTTPS.