Hacker News Reader

Isn't the problem that VS Code has no permission model (restricting of them), so all extensions can do anything?

While it is, the same issue exists in Sublime, Vim, Emacs, Gedit, pico/nano[1], IntelliJ, Android Studio, Eclipse, and every editor.

I think Xcode may be the exception but Xcode plugins also can’t do much.

I think Emacs and Vim will be lower probability targets than VS Code, though.