I only found out by accident that deleted files end up in an online-only Trash folder instead of being deleted. From a privacy and security centric company I find this quite shocking.

I would expect at the very last for this to be:

a) Opt-in, preferably with flexible retention.
b) Much, much more explicit, and definitely not entirely obscured by the app and only discoverable via the web interface.

I don't want to have to remember that files I deleted are still stored at online at Proton, and having to go to the web to ensure they're really gone.