For example, they assisted a fascist government persecution of environmental activists.

I don’t know a ton about that situation, but if you stick to the facts and stop going off wild speculation (like so many here love to do), you can start to understand the “why” of that situation. A journalist’s accounts were blocked because a CERT (separate from Proton - they are all over the world) reported them to Proton. The accounts weren’t even deleted. They were, in fact, reinstated.

The only facts we know:

1. The journalist’s timeline
2. Proton’s response

That’s it. That’s all the information we have.

Look at it through the lens of Occam’s Razor:

• The CERT/Proton maliciously targeted this journalist, OR
• The CERT recognized a usage pattern similar to that of a malicious actor, passed that information to Proton, and Proton acted accordingly

Which of those is more likely?

If I ran an email server that provided encrypted email, knowing 1) that potentially malicious actors could be using it, 2) that I could be prosecuted for allowing malicious activity via my services, and 3) that I was informed of potentially malicious activity by an organization that specifically deals with that kind of thing - I would preemptively block those accounts as well. You would too - don’t lie to yourself.

Regarding the “ghosting”:
My guess is that Proton probably has a policy or something in place preventing their “normal” support from even speaking to owners of blocked accounts when Legal (or CERT, in this case) is involved - just like almost every other company that has customer support. Which would quite easily explain why Proton took the “shoot first ask questions later” approach. And when Proton was inevitably called out by the owner in question, who turned out to be a non-malicious person? That’s probably when Proton leadership actually got wind of the situation and decided they could reinstate the accounts. In nearly every company, leadership is almost never involved with customer support until it becomes high-visibility - like being called out on social media.

I could be totally off here, but again, I’m only going off of the facts of the situation and what I know about cybersecurity practices (having some experience there myself).