A few (German language)sources: https://www.tagesanzeiger.ch/der-geheimdienst-will-auch-die-internetkabel-anzapfen-895734682308

https://www.republik.ch/2024/01/09/der-bund-ueberwacht-uns-alle

Basically: The Swiss Intelligence Agency do monitor all traffic going in and out of Switzerland(including incountry routing that uses external routes)and have the right to safe as much traffic as they want for 18 months- and can force swiss companies to give them access to their infrastructure even when they do not provide a service for non-swiss customers. Coming from a Intelligence agency that had the highest amount of files of their citizens of all democratic nations once (see Fichenskandal) it is more than troublesome.

Additionally swiss privacy law itself,while improved in 2023 after years of doing nothing, is still inferior to the GDPR. Unlike the GDPR it is not necessary for a person to explicitly consent to data collection unless the data is deemed especially sensitive. Unlike the GDPR there is no time-limit to notify authorities of data breaches and it is only mandatory for high risk breaches. And the right of data deletion is severely limited as the company can refuse to delete the data if it is still deemed "necessary" for the original purpose.

For me this is also why I can't take Proton and Threema seriously. Whoever uses "swiss privacy law" as a marketing catchphrase without lobbying for improved laws (especially before 2023). And Proton openly lies on their "Why Switzerland" page.