Yeah that confused me as well, the affected versions don't line up with the patched version either. I think it was fixed in 1.71.1 as per https://github.com/microsoft/vscode/security/advisories/GHSA...