I don't see how it's a revelation that governments are able to use warrants to force companies to provide data. And we already knew that Protonmail could serve

I don't see how it's a revelation that governments are able to use warrants to force companies to provide data. And we already knew that Protonmail could serve malicious code if forced to, that's been a common criticism of their mail service from day one. To the extent that it is possible on the web today to do clientside encryption, Protonmail does clientside encryption. Yes, it's bound by platform limitations around code signing and browser crypto. But in a broad sense, all of the apps you have set to auto-update (including privacy gold-standards like Signal and Wire) are vulnerable to malicious update attacks if law enforcement is able to compel them. That has always been true. So what new information have we actually learned at this point? The only interesting part of this story to me was the idea that Protonmail might go beyond their legal requirements in assisting law enforcement. That part appears to be false. No one should be using a 3rd-party service, whether advertised as "truly private" or not, under the expectation that the parent company is going to just ignore warrants and gag orders.