One could fairly argue that maybe such people shouldn't have access to a system, but it is a reality.

More that, such people shouldn't be allowed to be sysadmins, yet self-host and/or expose any ports to the internet.

Also, side note: Regardless of where you switch to, get your own domain! I cannot stress this enough. If you ever need to switch providers (which you'll eventually need to), you're gonna have a much easier time if your email is me@mydomain.tld, just pointing DNS at your new provider, bulk transfer/export all previous emails, and voila.

Well, that's it, I'm never touching Proton again.

As for suggestions: I haven't used Tuta, but I've only heard good things about them. Personally I use mailbox. They have drive and calendar, they're German, and they do/support a lot of cool stuff regarding FOSS. I'm not sure about slop, but from a quick glance I couldn't find a single mention about AI on their website, not even in their job listings. I don't think they have official clients, but they support open standards like SMTP/IMAP, WebDAV etc.

I haven't used their drive and calendar though, only email, since I self-host Nextcloud (if you're into self-hosting, I highly recommend it).

I disagree. Updates SHOULD be optional, as long as you own your PC. Now, for a work PC, where your employer actually owns it, it's them who decide what's optional and what's not. In that context, I think it's every IT department's responsibility to ensure security updates are pushed out and applied.

Linux.

Or literally any other OS than Windoze.

What you're talking about is basically an encrypted backup. Seedvault does exactly that, it's included in many custom ROMs, including GrapheneOS.

This is great, but how can we be sure this won't happen again in the future?

The higher the number, the newer the generation of USB. Mostly it means they have faster data transfer speeds and can output more power when charging devices.

Yes.

Sudo: Always uses the root user to get access to run a command, no matter which user you want to run the command as. Doas: Uses the user you want to run the command as to actually get access to run the command.

Not really. It's more similar to if the webserver was connected to the internet through a VPN with it's HTTP(S) port forwarded through the VPN. You connect to the VPN's IP address, which forwards to the webserver's IP which stays hidden. And you yourself are also connected to the internet through a (separate) VPN. Now, instead of a VPN connection, both you and the webserver are connected to the internet through Tor circuits.

This video does a good job of explaining how it works.

When a regular website is visited through Tor Browser, Tor protects/anonymizes you as a user. If a website is hosted at an onion address, the web server is also protected by Tor, the same way as you are.