>If you have an app that is literally attacking you then you are probably compromised

Sure, if your adversary is some literal hacker. But you also have to worry about legit companies that use aggressive "analytics". VSCode most likely logs keystrokes. It would suck if it also logs keystrokes that you type into other applications.