I don't think the headline matches the post. Usually when we refer to systems being "insecure" and "compromised", we mean so with respect to a third party.

A better headline might be: ProtonMail supports full E2EE, provided you trust them with your keys (if not, why are you paying for their service?).

The answer should be "because one day web browsers will be able to pin specific versions of specific web apps, with specific hashes, corresponding to specific releases tagged in their repo, which have been audited by a certain threshold of auditors that I trust".

What that looks like in practice is probably some mixture of the following projects:

https://github.com/kpcyrd/pacman-bintrans

https://users.rust-lang.org/t/rust-code-reviews-web-site-for...

https://paragonie.com/blog/2022/01/solving-open-source-suppl...