If you’re using VLC to play downloaded MKV and AVIs then injected threats are far from uncommon.

If a person already has a source for content they trust then go with torrents but if they don’t then it isn’t safer at all.