

Proton Mail is operated by Proton AG, which is a for-profit corporation.
That being said, even though Proton Mail is probably more trustworthy than Google and Microsoft services, it’s still handled by a for-profit corporation and therefore can’t be fully trusted.
Nowadays if something is owned by a corp I wouldn’t recommend anyone to get too attached to it. Use it while you feel it’s worth, but prepare to swap for something else eventually.
In other words: don’t ever fully trust your data to company owned software, and always look for a backup solution.

The entire philosophy of Arch is to put user in control. The PKGBUILD format is plain-text and reviewable. The documented best practice has always been to read the PKGBUILD and the .install files before building.
I’m not saying they shouldn’t look into measures to make it less prone to such attacks, but “take it down” is a very stupid take. If people can’t deal with the existence of AUR, there’s plenty of different distros to choose already.