[henearkr]

Would you mind showing me some evidence that software update systems are able to push to you e.g. a different Android update based on your device ID or specific IP? (not just country geolocation) (PS: your link is about deploying malware through other routes, not by normal software updates)

Because all the other means I can think of are just basic malwarfare.

As you need to rely on a vendor/distributor to get updates, then of course they are able to push you malware, there is absolutely no going around this first ring of trust.

Conclusion : there is no point in accusing Proton of anything... there are just being software providers (FOSS by the way!!!).