As I said, unless their official app distribution accounts were both compromised without anyone ever finding out and raising the alarm, and used to spread just a couple fairly hard to normally find instances of that URL, I think it's a lot more likely they just.... forgot to add it.
The alternative is much less likely: that someone specifically targeted this user with a message that knew exactly what they put in Proton's official contact form on their official domain, but chose not to ask for any information and just provided an answer to the question and then left.
