There are some suggested ways to largely fix this in-app, described at What should we require of VPN providers on macOS? - #77 by Overall-Bet3743 for example.
Which essentially comes down to: there’s no reason the packet tunnel exposed to the OS using Apple’s API is the same as the actual tunnel to Proton’s servers that the app uses. The Proton client could(?) switch WireGuard tunnels without tearing down the tunnel macOS sees, I believe.