It's nice that they offer hosted secure mail, like those on offer from enterprise tools (Proofpoint, Mimecast etc.), but it's not really E2EE email. Signing up to Protonmail may not require a mobile number, but a recovery email (PII) must added and linked the account.
Here is an example of a Protonmail to Gmail message (potential PII removed):
Delivered-To: xxxxx@gmail.com
Received: by xxxxx with SMTP id {...};
Mon, 6 Sep 2021 00:00:00 -0000
X-Google-Smtp-Source: {...}
X-Received: by xxxxx with SMTP id {xxx}.50.{xxx};
Mon, 6 Sep 2021 00:00:00 -0000
ARC-Seal: i=1; a=rsa-sha256; t={...}; cv=none;
d=google.com; s=arc-20160816;
b={...}
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-{...};
h=mime-version:message-id:subject:reply-to:from:to:dkim-signature
:date;
{...}
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@protonmail.com header.s=protonmail header.b={...};
spf=pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted sender) smtp.mailfrom=xxxxx@protonmail.com;
dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com
Return-Path: <xxxxx@protonmail.com>
Received: from mail-{...}.protonmail.ch (mail-{...}.protonmail.ch. [{...}])
by mx.google.com with ESMTPS id {...}.{...}
for <xxxxx@gmail.com>
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Mon, 6 Sep 2021 00:00:00 -0000
Received-SPF: pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted sender) client-ip={...};
Authentication-Results: mx.google.com;
dkim=pass header.i=@protonmail.com header.s=protonmail header.b=WRR3qgpc;
spf=pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted sender) smtp.mailfrom=xxxxx@protonmail.com;
dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com
Date: Mon, 6 Sep 2021 00:00:00 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail; t={xxx}; bh={...}; h=Date:To:From:Reply-To:Subject:From; b={...}
To: "xxxxx@gmail.com" <xxxxx@gmail.com>
From: {...} <xxxxx@protonmail.com>
Reply-To: {...} <xxxxx@protonmail.com>
Subject: Testing proton mail "encryption".
Message-ID: <1234567890@protonmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="THE_BOUNDARY"
X-Spam-Status: No, score=-1.2 required=10.0 tests=ALL_TRUSTED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE shortcircuit=no autolearn=disabled version=3.4.4
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on mailout.protonmail.ch
--THE_BOUNDARY
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64
--THE_BOUNDARY
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64
--THE_BOUNDARY--
Nothing special, certainly no E2EE encryption (to be fair, the welcome email explains this is Protonmail <-> Protonmail only) and STARTTLS, so it may be opportunistic encryption for the transmission. Not sure what benefit the Base64 encrypted body has as it's more bytes that the unencrypted message. Of course, encrypting with PGP and sending over Tor helps with anonymity, but it still relies on the recipient keeping everything secure their end.Email, no matter what you do to try and make it secure, is an inherently insecure protocol, that has been mangled beyond what it was intended for. I'm not suggesting that we shouldn't try to make it better, but that it might just be closing the proverbial stable doors.