Proton should be responsible no matter it uses the third-party open-source/propriety components or not.

If they decide to use third party libraries, that's their responsibility to review those libraries and include them to their code base.

Not "it's not my fault; it's others fault"

In the comment from the Proton team member, they repeatedly bring up the open-source nature of Bridge as if that fact alone is an excuses the litany of bugs in Bridge. ProtonMail are selling a premium service at premium prices, and yet a catastrophic data loss bug has existed in Bridge for a while. The dev team knows about it, and nothing has been done it seem? Have users been warned? are mitigations in place? It's just wild.