Either you don't get caught and can move faster, or you get caught and the penalty is usually small and a long way down the line, by which time your company will have either folded or grown enough to pay without difficulty.
That is not the scenario here. Cursor is being hunted by an extremely motivated corporate competitor. Cursor has been leeching the gorilla's blood and the gorilla finally noticed. Microsoft doesn't (necessarily) need the law here. They have it if they need it, but they can kill Cursor without needing to sue them. The disastrous outcome isn't a penalty--it's a critical mass of users switching to Copilot because they can't use their Microsoft extensions in Cursor any more. Cutting off the extensions on the same day that their Cursor clone went live was effectively a declaration of war from Microsoft.
The risks around proxying to the marketplace are real but that doesnt seem to be an issue yet. It also continues lock-in to VSCode which benefits Microsoft so they might not care.
What will happen in this situation depends a lot on the "reputation" of Microsoft vs Anysphere (Cursor) and their "marketing":
If Anysphere's "marketing" wins, they mass of users will be very disgusted by Microsoft's moves that they will avoid it like the plague to touch basically any avoidable product of Microsoft (including in particular Github Copilot) again.