If securing the contents of the message are the issue, then this is true but it's an opsec problem - no different than corresponding with someone who's downloaded malware.

But "another recipient leaked the data" isn't actually the same security breach as "my data was observed". If the message was sent twice to different people, no one even has reason to believe I was sent the data. If the message was sent with multiple recipients, GPG encrypts it symmetrically, then provides an encrypted copy of that key to each user - which means there's no way to check that I actually received a valid copy of the message.

It's a good point, though, that if you're planning the Arab Spring by group email or something, you should currently treat messages as at higher risk even if you use Protonmail.

Another recipient could also work for cops, which is also pretty hard to check.