argante Proton is a good replacement for gmail, but there's no guarantee it won't be able to steal your private key. Even though the code is open-source, the Proton server cant send you (and only you after login) a snippet of javascript code that copies the decrypted private key to the proton's server. And no one will even detect it.
This is very true, but we were comparing against HEY, and in their case, such an attack is not even needed. Such an attack may also fail for many reasons, including that you as the target actually aren't logging in to your account during the window they are able to do the attack. In the case of HEY, that would seem to not matter at all, as they can decrypt everything anyway.
The attack can also be largely prevented by using a regular app instead of the web app. That way they would need to ship the malicious code to everyone, as they cannot control who app updates are delivered to or not, and if the app is a third-party open source one, they would have no means to modify it at all. I don't know how Proton's official apps works though, if they are just wrapped web apps, or if they actually contain all the code and fetch no code from the server.