I have noticed today that we can set up a new email for recovery within the proton calendar app. That's make me worry that a malware or intruder could be able to access our calendar and then replace a recovery method by its own email, instead of one we might own.