Why does the post say "Protected:" but the share does not?

WordPress puts "Protected:" in front of the title of a post behind a password, and "Private:" in front of a private post's, in your site's language. That tells the person on the page why it is locked. The share buttons leave it off: the text X, WhatsApp, Telegram and the other networks that take text start a share with, and the email subject, is the post's own title, as in this plugin's Open Graph tags. Facebook and LinkedIn are sent only the address and read the title from those tags, which never had the word in front. A Share title on the post, while the plugin writes those tags, is used instead, as on any other post.

If a page cache kept a copy of the post from before this changed, that copy still shares "Protected:" until it expires or you clear the cache.