Proton are very transparent about what data is and isn’t stored, how data is protected and what (very limited) data may be available in the event of a legal warrant - going through all the proper channels.

Complying with legal warrants doesnt make the service insecure or not private. It makes it a legal and legitimate company.

It shouldn’t really be a surprise to any of it’s users.

Absolutely not

1Password has a blog post that talks about it here. https://blog.1password.com/1password-2fa-passwords-codes-together/

Ultimately it depends on your threat model and security vs convenience.