Everything pertaining this was gone over last month here Proton Mail Discloses User Data Leading to Arrest in Spain - #51 by ifled
They can’t encrypt recovery emails otherwise they would have no way to see the email needed for a recovery.
Proton is designed to be private, not anonymous. Anonymity requires more than PG recommendations can provide, as well as caring about proper OpSec.
Realistically unless you want every privacy provider to pull a Lavabit and shut themselves down due to a LEGAL request, theres nothing that can be done. And if every company shuts down then nobody is left operating to help protect privacy.