I see, makes sense. I haven’t used QubesOS before. Did you have to setup ProtonVPN as a qube and use proxyVM or does protonVPN have this all setup for you automatically?
Discussion
dom0 is a xen hypervisor on bare metal that never touches the internet.
In addition to your qubevms (fedora, debian, whonix etc) you also have a sysusb qube and a sysnet qube, the sysnet qube can be copied with each sysnet qube routed to different appvms (one without a vpn installed, one for country a, b, c etc).
since these qubes can run simultaneously, you can be connected to multiple vpns at the same time. You could also configure a proxy vpn as a vpn gateway. It's up to your use case. you can even spin up disposable appvms based on templates, or disposable sysnet qubes.
There's a default qube called vault where only your passwords and sensitive files can be stored. it is essentially airgapped. Cool stuff, indeed. Honestly can't imagine using anything else rn