I was actually considering to fix this while working on bug 36825. But then I thought that isn't this unnecessary? Unlike input fields or sometimes select fields, "Protected" field always defaults to "No" since it's coded to be that way. So it's never "empty" and IMO there really is no need to make it mandatory.
Yeah that's a good point. If we had different mandatory profiles for different categories, then it would be useful, as you could force staff users to be protected for instance. But I can't think of a scenario in current Koha where this would actually work as intended. You'd just end up making everyone protected by accident...