Note: this question might have been better on the Tor community despite being on-topic here.
Thomas Roth demonstrated that Protonmail was vulnerable to a Cross-site scripting (XSS) attack.
users would give up on Tor entirely if a website they want to use
ProtonMail does encryption and decryption of messages in your web
This ensures that we do not have the ability to independently decrypt
your messages and thus ensures the security and privacy of your data.
In order to do encryption and decryption in your web browser, we need
saving your private key(s) locally. ProtonMail also requires cookies
to be enabled so that we can store your current session information
and log you into your account.
(Last emphasis is mine.)
Therefore you have to make a choice. Either you decide to trust Protonmail to be secure (even though vulnerabilities have been found); or you walk away and find another solution.