@sir
For those looking, here is were ProtonMail made their statement:
https://protonmail.com/blog/protonmail-threat-model/
And here is a link to a video that covers the the Javascript claims.
https://yewtu.be/watch?v=AhdJzjC7Leo