- Certain core, built-in plugins do still contact MS servers.

- Vscode has limited what extensions can do on the platform. MS own extensions can do things that others cannot.

- Theia extensions can do what oss vscode extensions cannot. Theia supports all the non-ms specific extension API's so it is fully compatible with all/most vscode extensions. But Theia goes further. Part of Theia's vision is that you could ship your own Theia, the whole platform is open.

So, Theia is a safer bet. There is no rug to pull.

Also, think about chrome <-> chromium. When Google pushes for a new API that limits what ad-blockers can do, then Chromium has a problem. Because then it becomes a fork, as upstream becomes incompatible with chromium.