If you’re willing to pay for premium, Proton supports custom domains and catch-all addresses, so you can cut out all the extra mail relay stuff. Just give out vendor@mydomain.com, and it all comes back to the same mailbox. If it gets compromised, just set up a rule to trash anything to that address.
Thank yoy so much! I actually lay out the method step-by-step in one of the comments. 🙂