Recently switched from VsCodium to neovim - but still use Codium for some specific tasks.
My setup customization focuses around Telescope, Treesitter, Trouble & Blink.
But the advice I got was to start with vim keybindings in VSCode. I used those for six weeks until I got the hang of the basics and it had gone from frustrating to somewhat second nature.
Then I made the move.
I still use Codium for Terraform work (I have struggled to get the Terraform LS working well in neovim and I don’t use it often enough to warrant the effort) and as a GUI git client - I like the ability to add a single line from multiple files and I haven’t looked up how to do it any other way - I’ve got other stuff to do and it’s not slowing me down.
But I grew to hate Codium / VS code tabs in larger codebases. I was spending so much time looking for open tabs ( I realise this is a me problem). While neovim has tabs, it’s much more controlled and I typically use them very differently and very sparingly.
If I need to look up a data structure I just call it up temporarily with Telescope via a find files call or a live grep call (both setup to only use my project directory by default), take a peak, and move on.
The thing is - security risks are going to exist anywhere you install plugins you haven’t audited the code for. Unless you work in an IDE where there’s a company guaranteeing all plugins - there are always going to be risks.
I’d argue that VSCode, while a bigger target, has both a large user base and Microsoft’s security team going for it. I don’t see the theme being compromised as much as problem because it got solved and also prompted some serious security review of many marketplace plugins. Not ideal, but not terrible.