IDEs allowing to spawn actions in the user environment are still a big security risk.

Again that confirms that all the hype and grand announcements are not deserved. It also gives a good idea of the skills which are required to use those tools, clearly the setup process is involved if you want to don't want to be overwhelmed and drowning in bad code.

How trustworthy are the extensions you get in your editor or IDE? I'd expect most marketplaces to not be well harmed against such attacks.

Very thorough overview of everything you can do with vim but also your IDE vim emulation.