laanwj on Nostr: yes, non-PGP encrypted mails send and received from outside can be intercepted and ...

yes, non-PGP encrypted mails send and received from outside can be intercepted and read, like any mail provider

PGP encrypted mails (such as those sent between protonmail users) can't be, although the web-client could ostensibly be backdoored to either reveal your private key or certain mails. This happened with hushmail in the past, for example. It's unlikely you'd detect if you got a slightly different version than everyone else.

Using an open source bridge, along with your own mail client could avoid this particular scenario, but not many do this.

It's an improvement in security to say, Google which just stores all your mail in plaintext and can query it at will, but mail (even encrypted mail) will always suck for privacy.