If you don't trust VSCode, then don't use it. Or use vscodium. But if Microsoft wanted to be evil through VS Code, they could already do enough damage by just sending your projects to them, I would imagine.