> I wonder if vscode would still load the script if you click “don’t trust author”

It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712.

But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.