Yes, this is the way. Instead of mere advertising revenue, as with traditional radio stations, they can still do that with a stream while also collecting and selling all of your data. An still, too bad, so sad, if you drive into a rural area with no cellular signal. Steep mountains blocking satellite signal? Oh, well. Too bad there aren't local radio stations anymore, and very few have enough storage on their phone to have local copies of owned music.

VLC isn't compromised. Windows has a weakness in it's design.

VLC here is "clean". A compromised machine uses VLC to load a dirty dll file, because Windows allows this, not because VLC is doing anything wrong. It is essentially a Windows flaw that the attackers are using VLC to trigger, just because VLC is very common on so many PCs. The same thing could happen with other apps.

This article says that the perpetrators use a "clean" version of VLC to exploit a weakness in Windows. The vulnerability here isn't with VLC. It is with Windows. You could never use VLC and fall victim to DLL sideloading attack.