Which is still bad? Why would blind report warrant disabling accounts? It's like those DMCA takedowns.

Clarification:

CERT Fd up and called two whitehat disclosure accounts malicious

Proton did not check these accounts before they torched them.

Specifically for the type of privacy and security that Proton offers, I would expect a slightly higher level of customer service. Perhaps a message to the end user saying we are considering terminating your account. And giving you a chance to appeal before you knock it out.

This is by far not the worst thing they've done and in some sense it's not completely unreasonable. But I think they could do better.