Usually my computer is behind a nice and secure firewall.
When I use vpn I tunnel through it, which is part of the point.
It does create an open connection to the wild and dangerous Internet.
How likely is it that someone can attack that connection and harm my system in some way?
What firewalls and mitigation technique does Proton have on their end? Just NAT?
I am not an expert but I think when they try to attack the VPN tunnel, they attack the VPN server itself.
Also, assuming you are not targeted by the government or some other powerful institution, there is almost no probability for someone to get into your system.(only if you get malware from the internet that take control of your machine does not depend on the VPN. Proton VPN Plus offers NetShield so I think that takes care of the malware if you have the subscription).
In conclusion, I think Proton VPN will guard you against most of the dangers that may occur to your local network or machines. The part with malware depends on you, which sites you browse, what you download from where, etc.
Hope that give you a brief answer for your question.
Unless you have explicitly set it otherwise, your firewall will still be checking what comes out of the vpn tunnel.
Bad actors are continuously (automatically) scanning vast lists of different IP addresses to see if they find something suitable for their needs.
Like all IP addresses associated with a Comcast (Broadband ISP).
Traversal to see if they can find any vulnerable modems at the other end.
Or some other suitable device.
Used to say that an unpatched Windows XP machine would be infected in less than 10 minutes after hooking it up to Comcast.
You can say that they attack Comcasts servers, and you are right, but
each customer has his own IP exposed to the Internet and is potentially vulnerable.
Again, these are not targeted attacks on a specific server,
it’s a continuous automatic process that is looking for low
hanging fruit.
Someone might have the IP ranges they think are being used by ProtoVPN and do the same with, with the same results.
My firewal is a physical firewall, its own hardware 
I dont consider modem or router to have that role.
This is not the case.
You may think of a software firewall on my computer.
I mean at a hardware firewall I use for the Internet at home.
The VPN tunnels through it (which of course is one of the reasons to use a VPN)
I am not sure you understand what a VPN is and is not.