Proton only started logging his IP after they were legally forced to do so, just like any other law abiding company would have to do.
Proton offers an onion site of Protonmail which the activist should have been using since he allegedly committed
theft and property damage, crimes - the latter two - that enable surveillance
this is a case of user error and bad opsec, not a company bending over backwards to share their users information. If you’re going to do things that are likely going to get you arrested, no matter how noble the cause, make sure you have excellent OpSec