Edit:
If you're using them for an organization that uses Exchange/O365, the admin would need to make sure IMAP/POP protocols are enabled over TLS/STARTTLS, as opposed to using EAS. However, if you're dealing with mail in an organization, you're probably not using your own encryption keys to being with.
The justified concerns the security community has with ProtonMail is: Crypto in the browser is bad (mitigable with Qubes), and How do I know PM isn't serving me a backdoored JS.
IIRC, Helm has auto updated binaries so backdoor-free code isn't a delta. The best I can come up with is: server+CPU observation/isolation is stronger on local hardware relative to PM at the cost of network observation. Hypothetical: "Ok a Spectre-style attack is out, spam emails and let's do some timing-correlation traffic analysis"
Technically, there is: Encrypting our own mail with our own keys.