Poor OPSEC set up is on the user. Proton and Tuta offer private payment options. And provide ability to fully maximize your privacy and anonymity. In this case, the activist did not follow and set it up properly. That’s on the user.
What would you have Proton do? Break the law and not provide details it had for a legal order?
What you and everyone should know: the company/any company can only give info they have. If you can use a service they provide without providing any info, that’s what you should be doing if you’re going to be engaging in sensitive acts as an activist.
This is like being mad at Proton for your account being hacked because you did not have 2FA and used your birthday for your password. Buddy.. that’s on you then.