Not too familar with Qubes, but it looks like it offers security by using virtualized domains (e.g. one for your dev environment, another for personal browsing,

Not too familar with Qubes, but it looks like it offers security by using virtualized domains (e.g. one for your dev environment, another for personal browsing, etc.) and the interactions between the domains are controlled. However, in the OP's case of a VSCode plugin containing malware, his entire dev domain will as a result be compromised as a result of this plugin. If he uses the same VSCode plugin in his personal domain as well, that will also get compromised. I wonder if an approach similar to Firejail would work better, by say severely restricting what VSCode can do (e.g. what directories it can access, controlled network access, etc.).