Microsoft has silently added their GPG key and their VSCode repository to Raspberry Pi OS (formerly Raspbian)
Even if you don't install anything from their repos it still pings MS every time you apt update, plus allows them to possibly override packages you install.