Here's a sampling of stuff I've semi-recently encountered on Github that all spy on you by default. For some, it's undocumented, for others it's a minor subsection in the docs. (Some of them are source-available not free, I didn't keep track as I collected the URLs.)

https://github.com/zed-industries/zed

https://github.com/microsoft/vscode

https://github.com/keystonejs/keystone

https://github.com/meilisearch/meilisearch

https://github.com/hasura/graphql-engine

https://github.com/manticoresoftware/manticoresearch/

https://github.com/coder/code-server

https://github.com/loft-sh/devpod

https://github.com/quickwit-oss/quickwit

https://github.com/rilldata/rill-developer/

https://github.com/hocus-dev/hocus

https://github.com/firezone/firezone

Here's a write-up of how bad it gets -- it's pretty obnoxious: https://www.roboleary.net/tools/2022/04/20/vscode-telemetry....

VSCode is proprietary.

That's why the difference between Codium and VSCode matters. Actually, IIRC the code from the ms repo does not do telemetry, they add it to the binary they distribute.