alt Hacker NewsIt's used by most users, that's what they are saying, it doesn't matter that the file format is obscure.
If you make a video player based on ffmpeg you take input videos. The attacker can share a specially crafted video with the victim. Same kind of attack as sharing word documents.
when it comes to security popularity doesn't matter all that much. If something is not used and insecure then the decision should be to drop the feature, not to ignore the security issue.