Windows isn't based on DOS, though. It hasn't been for a very long time. Linux isn't sandboxed. Userspace applications can be sandboxed. There's a difference.
There's also Migadu which I currently use. It doesn't have all the bells and whistles that providers like Proton and Tuta have with their E2EE but they don't use any shady marketing or track you. Requires a custom domain though.
I recommend switching to a custom domain in the future so you can avoid situations like this from happening again, this way you won't be locked down onto a single provider.
They have a large following on Mastodon so this doesn't really make much sense. I'm inclined to believe that they left due to the hate they were getting because of the recent controversy.
+1 for Migadu. Their basic plan (more than enough for most people) is extremely cheap. No vendor lock in. And their support team is by far, the best I've encountered.
Absolutely essential is using a firewall and set it as strict as possible. Use MAC like SELinux or Apparmor. This is extremely overkill for a personal server, but you may also compile everything yourself and enable as many hardening flags as possible and compile your own kernel with as many mitigations and hardening flags enabled (also stripped out of features you don't need)
I've never heard of nsjail, so I wouldn't know. But there's also bubblewrap which is used by Flatpak for sandboxing. It's very small, although a bit annoying to use.
Windows isn't based on DOS, though. It hasn't been for a very long time. Linux isn't sandboxed. Userspace applications can be sandboxed. There's a difference.