The problem is not VS code itself. It's the fact extensions can access things outside of the editor. As far as I am aware, no editor sandboxes extensions.

Part of the problem is that people are adding a metric fuck ton of extensions onto a text editor trying to make it into an IDE.

If you start with an IDE first you likely need far fewer extensions.