

TL;DR:
When you delete in VS Code it stores the files in
~/snap/code/<version#>/.local/share/Trash
Which isn’t automatically emptied by gnome like ~/.local/share/Trash
Updating the package also creates new copies of this directory under a new version, leaving orphaned files/directories which contain data that you deleted.

The lines get kind of blurry, it’s a bug that allows people executing code as your user(not sure the specifics of snap’s security) to see things that you thought you deleted.
This doesn’t give an attacker anything particularly useful. If they have that level of privileged already there are much more fruitful avenues of attack that don’t require digging through your trash.