The "airtight hatch" story is not fully applicable here. Executing VScode instead of a random exploit payload could be considered an increase in privilege, beca

The "airtight hatch" story is not fully applicable here. Executing VScode instead of a random exploit payload could be considered an increase in privilege, because you're going from an unsigned and unknown binary to one that is signed by Microsoft. And VScode is probably allowed through any outgoing firewall rules because the main user of the machine is using it, while a random exploit payload would not be.