Why do we still need VIP when using SCAN?
Clients connect to the scan listener(s) listening on the scan vip(s). The scan listener forwards the request to the appropriate local listener listening on the node vip. So the node vip is still used for connecting.

The listener must run on the node you end up connecting to spawn your server process. The scan listener running on rac1 can not spawn a process on node rac2. You need a local listener that listens on a local address. That local address, even if it is just virtual and not fixed, is the node vip.

Overview of Virtual IP Addresses


  A typical connect attempt from a database client to an Oracle RAC
  database instance can be summarized, as follows:
  
  
  The database client connects to SCAN (which includes a SCAN VIP on a public network), providing the SCAN listener with a valid service
  name.
  The SCAN listener then determines which database instance hosts this service and routes the client to the local or node listener on
  the respective node.
  The node listener, listening on a node VIP and a given port, retrieves the connection request and connects the client to the an
  instance on the local node.
  


The original point of having the vip was to provide the ability of quickly returning a response in case of a node failure.

If rac1 goes down and a connection attempt is initiated using its address, the client must wait for a tcp timeout before getting any response. If the connection attempt is made using a virtual address, even if the vip is running on rac2 and it does not serve requests, the client gets an immediate response and can go and try another address listed in its connection string, thus making the overall time to connect lower.

Overview of Virtual IP Addresses


  If a node fails, then the VIP address fails over to another node on
  which the VIP address can accept TCP connections, but it does not
  accept connections to the Oracle database. Clients that attempt to
  connect to a VIP address not residing on its home node receive a rapid
  connection refused error instead of waiting for TCP connect timeout
  messages.


Also some old clients are unable to use SCAN.