@sir

For those looking, here is were ProtonMail made their statement:

https://protonmail.com/blog/protonmail-threat-model/

And here is a link to a video that covers the the Javascript claims.

https://yewtu.be/watch?v=AhdJzjC7Leo