They’re all like “privacy and freedom”, “take control of your data”…

That’s correct. And the fella used that freedom and control over his data to deanonymize himself. It isn’t proton’s job to be completely idiot-proof. They tell you what it is they do, and they do it. There are no false claims made.