To be fair, if you're the type of person who may draw any amount of attention to yourself then it's really up to you to use the tools made available to you to keep yourself private.

Sounds like they didn't utilize the onion service. Sounds like they didn't do enough on their own to protect themselves.

While I know this looks bad for ProtonMail, the reality is that service providers aren't investigative units and can only share what information you give them to share when given a lawful order to do so.