Fastmail's security is top notch. They're using Cure53's DOMPurify and their team understand these vectors really well, with strict filtering. Their pixel tracking blocking was better than Hey's when last I checked, and I reported three leaks to Hey that were not fixed for some time. Fastmail also run one of the best bounties I have ever participated in. I would even say significantly better than ProtonMail, having participated in both bug bounties.