At some point it has to be unecrypted to be useful. That's where the vulnerability is.

Depends whether and to what extend your service provider needs it - for Proton, it's always client only decrypted