Wordpress - What is a "protected" post status?

register_post_status is used for creating a custom post status. The protected argument, if true, specifies that a user must be logged in and have edit permissions on the post to view (preview) it.

For example, you said that the "draft" post status has protected set to true. This means that you can only view (preview) the draft post if you have permission to edit the post. Once the post is published, the protected parameter is turned off and anyone can view it.

If you are creating your own custom status, you might want it to be protected. For example, you could have a post status called "on_hold", and when you set a post to that status, it would no longer be visible to the public, but still visible to the administrators of your site.