> Zed felt it had the right to download, install, and run node.js without any permission just to run some LSP (which I don't even use).

Yes. This is bad. Zed keeps installing and running all sorts of random background stuff. This should be an opt-in.