I agree with you on those points. I haven't really looked into VSCode extensibility, but I had a sour experience with Visual Studio when developing an extension for changing text editor colors.
But nonetheless, I think the ability to disable extensions has a lesser impact than removing extensions if security is the concern. Said in another way, I believe being able to remove them is worst than being able to disable them.
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.