distro packagers typically undo vendoring for lots of reasons (among others: smaller packages, fixes propagate automatically, which is particularly important with security issue)

Given how similar libav and ffmpeg still are in places, they might even consider replacing the vendored ffmpeg with the packaged libav (or vice versa, if done the other way).

But the fallout would be for VLC to deal with ("VLC breaks on my Debian, it must be crap").