Far more VPSs are compromised through local VM attacks than provider attacks.

This is a bit like saying "When you're temping your chicken, always remember that your grocery store could be putting arsenic in it at the store". Yea, that's true. But the average consumer gets sick far more often from mistakes in the kitchen than mistakes in the grocery store.

The person in question on HN was planning to self-host email. Sure, if you don’t want Google or Microsoft in particular reading it, I get it. But if you think nobody can read it now, that’s a major (potentially life threatening) mistake. Gmail might actually be safer in many circumstances.

If you don’t want Google or Microsoft reading your email, Proton would be better still than Gmail, wouldn’t it?

If any of your recipients are using Google or Microsoft then they already have your email whether you use Proton or not.

I wouldn't say meaningless, no. If your provider is not too diligent about checking subpoenas, they will let a sophisticated targeted attacker in eventually. If your SSH password is weak, you will let any and all script kiddie in within the hour.