No, Proton does get a free ride here. The information they provided was the recovery email address, which they were required to do by law.
The only data they don’t encrypt (can see) is that which they absolutely need to store unencrypted. If they encrypt your recovery email address, then… they can’t send you any recovery emails to it since they can’t see it.
This is 100% the fault of the user.
All any service can do is give you the best tools available to maintain your privacy, but they can’t stop you from shooting yourself in the foot.
Firefox is also great for privacy, but if I use it to fill out some info on some phishing sites then that’s not a them problem.
Don’t forget that most of your email arrives at their servers unencrypted, supposedly they immediately encrypt it, but you have to take their word on that. And there’s always the possibility that they are forced or just decide to make a copy of emails as they’re encrypting for your inbox.
