Standard Debian packages have access to things like your home folder and other things that can be accessed without superuser level access. If you’re not okay with that, don’t install it.

If a flatpak package is available, it can have it’s permissions controlled by Flatseal, allowing you to restrict Spotify’s permissions.

I basically do exactly this, but I am running the reverse proxy on my home computer: the VPS is literally just acting as a proxy, for which I use wireguard to tunnel the connection. So far it’s worked great, though initial setup was a pain.

Unlike a car which is bought once and is mostly outside of vendor control once you have it, Proton mail is a service that requires continuous trust in the company since they offer a service. This means I no longer trust Proton as much, which makes me much less inclined to use their services.