Comment by hahn-kev

It's no worse than vscode. Sure there's permissions, but it's super common for an extension to start a process and that process can do anything it wants.