Trust is always relative to a threat model. I trust that the people who work on VS Code won't do all sorts of nefarious things that hackers might want to do if they can get code running on your system. I trust that their telemetry settings do what they say they'll do. And if someone finds a security bug, they'll fix it.

I don't assume that there won't be security holes, but in effect, I'm assuming they probably won't affect me.