Before: One could subscribe only over the web.

After: You can subscribe in-app (in addition to online) and Apple takes a cut of that purchase. You aren't allowed to mention anywhere in the App that there are alternate (perhaps cheaper) purchase methods.

Quite simple: You are not allowed to push any further updates until you either 1) allow the subscription to be purchased through Apple or 2) make your service completely free so no IAP is required.

Apple has been rejecting app updates for lesser reasons.

One can’t, and wasn’t.

If you read carefully, you may reconstruct the actual issue and the store policy:

Either Proton mail removes mention of their premium service from the app (and the app can still provide this service to anyone paying outside of App Store) or they keep it and then provide in-app purchases.

They clearly decided to use IAPs. If you ask me, this is a smart move, as many customers won’t be bothering with other payment options.

They tell you to add IAPs that are to their liking, or you're out of the store for violations of the App Store Review Guidelines.