Expecting vscode to police every single dev using it instead of a company is bananas.

The very first page[1] of the VSCode remote documentation makes it perfectly clear that VSCode remoting is more akin to running an Emacs server on the remote than TRAMP.

[1] https://code.visualstudio.com/docs/remote/remote-overview

Every dev with ssh keys into prod should know it.