I’d personally consider that sufficient grounds to accuse Proton of stealing its customers’ data.

At the (miniscule) risk of sounding unnecessarily harsh on tech, any customer data that gets sent to company servers without the customer’s explicit, uncoerced permission should be considered stolen.