Quite. VSCode asks with a little pop-up in the bottom right (for me, on Gnome) when you open a project that might benefit from a particular component, and you can accept or decline it.
It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't.
I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.
oh come on, if an extension comes with no source code it means it comes with a native binary (because otherwise it's JavaScript and there, are, no, good, JavaScript, obfuscation, in, this, world, period), and does it really matter if it has network access ??? it may as well just inject cryptominer to your ~/.bashrc.
It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't.
I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.