You are mistaking the word "secure" for the word "protected." They are not the same. Look up the words.
For laughs, I did... and it's a silly distinction. I'm old school... when I secured systems I also included "process" everything from password management, document protection (storage/handling/shredding/etc.), procedure, human element, and so on.
I guess nowadays they see "security" as just the technical aspects, and then put that along with the human and other "soft" aspects into "protection". Must be some IT college-speak stuff or something.
In any event... call it security or protection... they're not binary at all... it's all about level or degree of "secure" or "protected".