What prevents ProtonMail from sending me the wrong public keys?
ProtonMail has a support page about this topic.

ProtonMail does not transparently solve this problem. By default, the client has no way to know if the server has provided the correct public key, it just implicitly trust keys sent by the server. Therefore, by default the client has no way to protect against man in the middle attacks from the ProtonMail server.

However There is an option to turn on manual trusting of keys, "Settings > Security > Address Verification (optional) > Prompt to trust keys". In this case, when encountering an unknown public key, the ProtonMail client will notify the user that the key is not trusted, and prompt them to "pin" the key. Keys must be pinned, per contact. Messages to contacts without pinned keys will be sent using keys from the ProtonMail server.

A pinned key is stored locally the client, and (presumably) encrypted and sent to the server, so it can be used from other devices when decrypted with the user's password. The client will always use the pinned key to encrypt messages for the corresponding address, and it will display an error if a message received from that address isn't signed with the correct key. It up to the user to verify that the key is correct, like in normal PGP.