This is the same legal basis cartographers / mapping providers sit on. You could reach exactly the same result, but the process cost them, and the resultant IP, even if derivable from publicly available info (surveying streets, surveying camera locations) isn’t. They can’t come after people mapping cameras they can see, they can come after people scraping their DB / breaking TOS / accessing systems for which they do not have access rights.

Their claim, rightly or wrongly, is that it came from private data (a researcher got an exposed key and downloaded data with coordinates).

But I think as long as Proton wasn't that researcher, there's no case to argue there.