Not being able to see the source code of extensions, and having them loaded and executing remotely really ought to be a non-starter, but for some reason we find ourselves ok with this?
Maybe there are checks and balances? I really don't know - but I certainly don't know what they are.
I'm actively exploring alternative cross-platform editors for this and other vscode usability reasons.