no one can ever know Protonmail is really encrypting mails. Opensourcing a piece of software doesn't really mean that Protonmail deployed that and also doesn't really mean that you are using their promised encryption.

Surely they could have an audit/attestation by 3rd party?

Yes, but did they?

Yes https://proton.me/blog/security-audit

Worldcom passed audit I recalled. Enron too. FTC gave Bernie approval. How about FTX? Remember once uoon a time there was big 5 with one of them as Aurther Andersen? Did anyone auditted Securitum? And oh yeah did anyone actually verified what is being auditted and what is not? When so many info about a compromised Protonmail to law enforcers that Proton didnt even actively deny, I give Securitum as much confidence as AA 2 decade ago.

In your logic it seems impossible to be considered secure, since audits do not matter. Which email service do you consider secure and why?

you can also build it yourself

You can read some forums and head over to mastodon or discord. Protonmail isn't secure. Some seems to hint compromised. Use it like what you would with Gmail or Yahoo. As for paying, no thanks. Nothing secure about it. You get more security buying separate VPN and even having qqmail (yes, Xi can read your email, but wont have the authority to send law enforcers to your home in Oslo or NY). NSA and CIA can...but will have zero chance of reading your qqmail.

You're shifting the effort on the others instead of providing convincing arguments. That is not very convincing.