You're missing the point. GP is discussing binaries. I.e., the assumption is that published source code (on Github) is perfectly fine, and then either the (malign) developer is changing the code before compiling it, or the (malign) third party is somehow using some vulnerability to replace the official binaries with compiled code of their own. And then you think that you are using "VSCode without the telemetry code", but in reality you're running a botnet.