As discussed on the mailing list:
user Roberto Nibali had a problem where a file wasn't saved with encryption. The cause turned out to be that he had called
Although the javadoc of both methods is clear, I see a risk that this happens again, e.g. when people combine existing code.
Solution: set allSecurityToBeRemoved to false when protect() is called and log a warning.