You mentioned almost nothing? Tuta can even more easily change their privacy policy. Not saying Tuta isn’t the right choice, but it’s worse than a lot of people make you think it is

Tuta is located in Germany which has more power to look into your data than the Swiss government, but it’s mhe.

Also what separation of power do you mean? Proton is also owned by a non profit and Tuta is just a Gmbh which is owned by two individuals it seems. Changing something regarding the non profit or the structure is pretty hard to do

Tuta is however more open with that you can find their annual report or at least part of it if you want.

Many of those are caused by people having insecure accounts without enabling 2FA etc. And there is a lot of money involved, even the top TF2 accounts are worth tens of thousands of euro’s