Because what they had was some kind of admin access to Cursor's mirror of OpenVSX, and not anything else.