> Any E2EE service that has a webapp is susceptible to this

But I don't think everybody are making webapps to service data of their E2EE product, isn't it?

The key point is, if the webapp can be compromised by anybody who are in control of the front-end assets, then what's the point of the entire ProtonMail E2EE thing? Especially when you have other solutions like GPG which also is an open protocol?