I can confirm that the virtualbox-vnc package installs fine. About the hack: I noticed that Arch changed ways of installing things with VirtualBox 5.1.22 release: https://git.archlinux.org/svntogit/community.git/commit/?h=packages/virtualbox&id=ffe48311c6d058617b482fc9ba1138d30c78fd23. Perhaps it's applicable and less hackish.