VLC doesn’t attract a huge amount of attention because they don’t really make any money and would just get forked if someone did try to destroy them.
However, larger distros with commercial backing (OpenSUSE springs to mind) often won’t directly include potentially patent-infringing packages, so you have to get them from a quasi-third-party repo like Packman.
The point being made is that that means you must trust them with your private key, and you can’t have say two private keys - one for low security content they store, and one for more sensitive stuff where the key stays on hardware under your control.
I expect they are talking about the ‘irrevocably’ part, as one of the core tenets of GDPR is that consent can be withdrawn.
I couldn’t say whether or not that applies here.