Most extensions run in vscodium-server, extensions run either as "Local Extensions" that run on the host and "Remote Extensions" that run on the guest. You can clearly see in the UI which ones run where.

I only have a single "Local Extension" and it is open-remote-ssh itself.

Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.

When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.