Text editors with plugin support as potential vectors of malware is a pretty well known problem. It’s why at the very least organisations should be auditing the plugins used and actively monitoring them.