ViMusic is no longer maintained so any Google side changes (that are very frequent recently) can break some features of it (like it already did with song authors) or the whole app. If it works for you then you don’t have to switch. I’m not familiar with any security vulnerabilities of ViMusic so it’s definitely not necessary to avoid using it (though I still highly encourage you to check its GitHub so you’re informed about any issues found) and it’s probably even slightly more privacy-focused than InnerTune but many users prefer actively maintained software for many reasons, including but not limited to the ones mentioned above.