It's not a question of trust, vulnerabilities can happen to anyone. Even if the devs at Microsoft were perfect (they aren't), all it takes is an rce in one of the libraries vscode depends on. (Like Chromium, which has happened before [0])

[0] https://www.electronjs.org/blog/chromium-rce-vulnerability