mmmm Do you have a link to back that up?
Quick internet search brought this one up, where ProtonVPN official account admits to those security flaws. This was five years ago.
https://www.reddit.com/r/ProtonVPN/comments/hssnac/tor_over_vpn_misleading_security_claims/
But as stated by the OP in that post, it is easy to verify the absence of a secure implementation of Tor over VPN by simply reviewing the code in the ProtonVPN client app, and seeing that there is no code for setting up Tor tunnels. And thus it is done server side, which is technically impossible to implement in a secure way.