Are VSCode users really that much more diligent? Are you auditing the source code for every extension you install? Do you even know if the github source is the same as whats hosted on the plugins repo?

The only real solution I can see is only installing plugins from large trusted entities.