Here's a sampling of stuff I've semi-recently encountered on Github that all spy on you by default. For some, it's undocumented, for others it's a minor subsection in the docs. (Some of them are source-available not free, I didn't keep track as I collected the URLs.)
That's why the difference between Codium and VSCode matters. Actually, IIRC the code from the ms repo does not do telemetry, they add it to the binary they distribute.
But yes, free software is not a guarantee against tracking. It only allows auditing and be modified.