that should also apply to vscode extensions and most other plugin systems. and this seems to get worse? one area where apple's strategy of copying the functionality of smaller extensions/apps makes sense security-wise..