Perhaps protons bridge has nodded off to sleep. Perhaps other software is using the [https://en.wikipedia.org/wiki/Localhost localhost ]IP 127.0.0.1 Thunderbird's oauth authentication implementation used localhost, just not port 1025 and we have seen issues with folk using web server software (mostly developers) on the same machine which consumes all traffic on localhost. Perhaps you have an antivirus program scanning mail and it is stumbling on outgoing mail on localhost. It does ring malware bells as they tend to use that service address as well to send spam on some systems. Unfortunately the proton "bridge" is in effect some sort of mail server installed on your local system, how it works is basically unknown, so why using it might fail is really just guesswork