And yet, this entire class of abuse is only possible because Microsoft refuse to implement any kind of permission management or sandboxing for extensions.
As a vscode extension author, I am scared by the power I have. I am not at all surprised by what happened in this story.