Vscode(ium) extensions are also pretty weak security wise in general. There's little guardrails on what an extension can do.

On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.