This happened years ago afaik, but lemmy keeps sharing it around for some reason.
For context, proton encrypts the traffic, not the IP Address. While I dont remember how long IP Addresses stay in their logs, you can easily avoid exposing your true IP address by using a VPN, which is clearly not what that acitvist had done.
Proton is still compelled to follow government laws in order to operate, and will hand over what info they have when compelled to. If that info is something their service can encrypt, such as emails, cloud storage, passwords, and so on, then it will look like jumped data when handed over. You IP address can't reasonably be encrypted, and neither can your primary email that is associated with you proton account. If your primary email has revealing info, then thats on you for not obfuscating it more. If you arent using a VPN to access services, then your IP address will be indicative of where your traffic might be coming from. The end user does need to take extra steps to make sure their traffic is secure, and proton does talk about this in their documentation.
Proton is one of very few companies Ive seen pass third party security audits. They may not be perfect, but they are secure, and I've yet to see that truly disproven.