Thanks for the pointer but I don't think this is what happened in my case. I never opened the marketing assets in VSCode. They reside in completely separate folders.
Allowing this to happen would've been incredibly stupid. But it's worth investigating further.
Even if they were scanning all the files, Copilot's terms [1] explicitly says they do not use the data to provide suggestions for other users.
> GitHub Copilot does not use these URLs, file paths, or snippets collected in your telemetry as suggestions for other users of GitHub Copilot. This information is treated as confidential information and accessed on a need-to-know basis.
[1] https://docs.github.com/en/github/copilot/github-copilot-tel...
>which may unintentionally contain user content, such as parts of a file you were using when the problem occurred
[1] https://docs.microsoft.com/en-us/windows/privacy/configure-w...