I never thought of ProtonMail as a secure-from-state-surveillance provider. Only as a secure-from-civil-surveillance-aparatus provider. A replacement for Gmail, no more than that.

If I wanted to conduct illegal activities I would not use my main account on it, at minimum.

Protonmail is a step up from Gmail/Outlook, but no more than that. You need more layers on top of it.