The technique is real and nasty, and worth amplifying so people see it coming.
But one precision, because it changes who you defend against. This is not a Proton failure. The mail genuinely originates from Google Groups, signed by Google, sent from Google's own infrastructure. The Cancel link is a real goo[.]gl shortener. The landing page sits on sites[dot]google[dot]com.
Every hop is a legitimate Google domain. That is the whole attack. No mail provider can hard block a real, signed Google Groups message without blocking every legitimate Google Group on the planet. Proton, Gmail, anyone, the same mail lands the same way.
So the failure is not filtering. It is Google's own services being used as the delivery vehicle, which is exactly why it bypasses everything. The only catch point left is the user reading where the link actually goes before they click.
treating the USB-C spec with extreme reverence like the Dead Sea scrolls scanning it and memorizing subsections 4.6.2.1: Default USB voltage and current are defined by the USB 2.0 and USB 3.2 specifications. All
USB Type-C Current advertisements are at the USB VBUS voltage defined by these
specifications.