Fair point, I hadn't considered this, but wouldn't they just disallow it?
Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.
Ah, that must have been AL2023, right? IIRC, it's tightly integrated with internal deployment toolchains like Apollo and Brazil (Amazon's internal package management and build systems).
Problem is: most employees don’t care to read these. Although I’m sure something like this could have been checked for during commit.