These risks apply to every Proton product. They are legal obligations and corporate practices that individual products cannot override. A subsidiary cannot opt out of an FTC consent decree. A company cannot selectively ignore its home country's intelligence law for one product. These risks set a grade floor of B+ — no Proton product can score better than this, regardless of its own privacy settings.