Here's a sampling of stuff I've semi-recently encountered on Github that all spy on you by default. For some, it's undocumented, for others it's a minor subsection in the docs. (Some of them are source-available not free, I didn't keep track as I collected the URLs.)
That's why the difference between Codium and VSCode matters. Actually, IIRC the code from the ms repo does not do telemetry, they add it to the binary they distribute.
https://github.com/zed-industries/zed
https://github.com/microsoft/vscode
https://github.com/keystonejs/keystone
https://github.com/meilisearch/meilisearch
https://github.com/hasura/graphql-engine
https://github.com/manticoresoftware/manticoresearch/
https://github.com/coder/code-server
https://github.com/loft-sh/devpod
https://github.com/quickwit-oss/quickwit
https://github.com/rilldata/rill-developer/
https://github.com/hocus-dev/hocus
https://github.com/firezone/firezone
Here's a write-up of how bad it gets -- it's pretty obnoxious: https://www.roboleary.net/tools/2022/04/20/vscode-telemetry....