You are talking about End-to-End Encryption. Zero-Knowledge Encryption means they don't have access to your mailbox because they don't know the password, it's not stored on their server, they only know the hash it generates (which is used to verify you know the password, but the password itself is never exposed).
Even though they can't get inside your mailbox they know all the incoming and outgoing metadata (addresses of emails sent/received) so they know your traffic (there is no way to encrypt metadata anyway, it would be like giving a letter to a mailman but not telling him who to deliver it to), but, say, court orders them to give access to your mailbox, they have no way of doing it, only someone with your password can read your emails.
Stored emails are encrypted in any service, the difference from Tuta, Proton, Atomic, etc, to Gmail, Outlook, Yahoo and others, is that they don't have the decryption key. But yeah, technically any of them could make a copy of unencrypted emails you receive and send (the later don't even need to since they have the key), but they can't do it retroactively. Proton had a few third party audits checking their services, but afaik Tuta hasn't.