Currently signing out of your GitHub account only removes the token from the secret store but the token continues to be valid, which means that if it was leaked the attacker can continue to make use of it.

To mitigate this, VS Code should revoke the token on sign out, see this API: https://docs.github.com/en/rest/apps/oauth-applications#delete-an-app-token