I agree very much, which is why I did not push too much the VLC web plugin. Yet I don't know how to solve this problem, in any another way.

On the other hand, Popcorntime and other soft are getting installed by users, so maybe if plugins are easy to install, maybe they could work... (?)

The "right" way to solve it is for everyone to use seekable MP4 (or seekable WebM), especially since things like Chromecast don't natively support anything else. That's hard to do but possible if you provide a highly desirable service (people will start to complain for torrents in unsupported formats).

WebM and mkv are the same container format.

Popcorntime doesn't open up my browser to security holes for every website I visit.

Every plugin you install increases the surface area for attacks.

Of course. But plugins are now in separated processes and plugins shouldn't autoplay (a contrario from flash).