The trojanised editor extension attack exposed a characteristic of development environments that rarely enters risk assessment: extensions install by individual decision and run with the developer's access.
That exists for a good reason. The productivity of anyone writing code depends on being able to adapt the tool to their own work, without filing a ticket and awaiting approval for each install.
The cost of that arrangement appears when a developer's machine accumulates production credentials, cloud keys and repository access across several projects, which is the normal situation in almost every team.
The answer that works isn't banning extensions, because that pushes installation outside any control. It's reducing what the machine can reach: short-lived credentials, separation between development and production environments, and review of what permissions each installed tool requests.
It's the same direction security products took in the period for agents, with their own identity and defined scope, applied now to the tool a person installs on their own.