Hacker News Reader

All these same things are true for emacs/vim/CLion plugins as well. You kind of either have to accept the risk cowboy style, do something in the middle (maybe only allow very well known extensions from source you trust), or live without the extensions.

Can't you host your own extension marketplace?

Then you have other problems. Maintaining the store itself, obtaining the extensions people want, and keeping the extensions up to date adds some overhead.

Looks like it should be possible, although I have no experience doing it myself.

https://github.com/coder/code-marketplace

Sounds like that's the price your org is willing to pay for your its flavor of Infosec.