Both things can be (and likely are) true. The issue is caused by Microsoft, and the VLC developers should address it. And not by instructing people to exclude it from AV scans.