Comment by roywiggins

VSCode remotes can execute code on the connecting clients, so a pwned remote server can pwn your local machine.