Visual Studio Code (or one of its many forks) is used by a huge number of developers, and the thing that makes it worth using isn’t really the editor at all. It’s the extensions which make it applicable to practically any workflow or language. There’s one for seemingly every language and every framework, and extensions that transform it from a simple editor to a productivity tool instead. Installing those extensions is a single click from a marketplace Microsoft runs, and that marketplace is the whole reason VS Code won. But it’s also the part that security researchers have been sounding alarm bells over for years.