How does one create such a list? How do you distinguish domains that have gone rogue (either ones that were legit then went bad. Or if the domain expired or was sold to a nefarious person)?

I believe in this case protonmail was hit by an algorithm based derank (not a manual action). What causes it is anyone's guess. But something series of events hurt their ranking. Its also important to note that PM was NOT delisted. They still were getting traffic from Google, they were just deranked.