These are actually false allegations which were originally spread by none other than Private Internet Access as part of a smear campaign. We have previously responded here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...

As mentioned in Mozilla's blogpost, they did their homework and thoroughly checked ProtonVPN, including visiting us in Geneva at our main office, which also refutes these allegations.