I’m sure you could diff the source code the package used, and the upstream Microsoft git SHA it is claims to be derived from:
https://aur.archlinux.org/packages/vscodium
Incidentally, there is now an open source remote mode extension, so I have no reason to use the proprietary version. No more telemetry from me!