It's caused by a stale plugin cache, which somehow triggers a blocking windows defender scan on application launch.

I only managed to figure that out thanks to this[1] reddit comment, which also includes a solution:

  Noticed this a while back with 3.0.23. Managed to troubleshoot via debug logs.
  
  Basically the plugin cache goes stale and has to rebuild itself every first launch. No clue why.
  
  To fix: go to C:\Program Files\VideoLAN\VLC (or wherever you installed) with a terminal in administrator mode.
  run the command: ./vlc-cache-gen.exe "C:\Program Files\VideoLAN\VLC\plugins"
  
  That will rebuild the plugins.dat file which should fix it.

No windows defender exclusion required.

[1]: https://old.reddit.com/r/VLC/comments/1skofwx/vlc_3023_windo...