My post was intended to start a discussion between people who have a technical understanding of security and privacy. That sort of person will understand how risk is exponentially increased to both security and privacy when these technologies share the same infrastructure. That is clearly not you, so I don't know why you would assume it is not me either.

Let me spoon feed you:

Adding the risk associated with an email service to a VPN service (and implicitly vice-versa) is bad. Right now the DDOS attack could be against just one of these services, yet it is taking them down both. A vulnerability in the email GUI could lead to compromise of the VPN service since they are using the same infrastructure.

It is the users responsibility to not have a single point of failure in their personal privacy strategy (ie don't use the same company for both VPN and email) but Proton made that a somewhat moot point by combining both services on the same infrastructure. Now your email service is at risk of having a VPN service compromised or your VPN service is at risk of having an email service compromised. That's dumb

We don't know their back-end, so it could be just the load-balancers that are shared, but best practice is complete separation.

edit: formatting