Wouldn't be surprising to find that security conscious people are more apt to alter their user agent string or have a plugin that rotates it often to counter fingerprinting. There are probably fewer genuine IE11 users than what is being detected.
>or have a plugin that rotates it often to counter fingerprinting
That's not going to fool any competent fingerprinting scripts. Blink/webkit/gecko have different javascript implementations so it's easy to cross-check whether your user agent header matches your "real" user agent. The only thing you're really going to fool are server side logs for user agent. If anything, using user agent spoofer is an entropy source (makes you stick out more) because most people don't spoof their user agent.
Rotating the agent alone, right, but it's part of a larger set of tools usually. I don't think anyone is implying that security conscious users are only doing that.
On the contrary, you could take the WhatsApp stance and say that everyone deserves a more secure email platform, not just those who know enough about technology to know that the default browser is not good enough. Not saying it's an easy task, of course, but that could be a goal for protonmail.