The Vala reference manual draft says

  "protected" asserts that the member will be visible to any code within this class, and also to any code that is in a subclass of this class.

And yet the following program builds without an error:

class Foo {
    protected void xyz() {
    }
}

void main() {
    Foo foo = new Foo();
    foo.xyz();
}

So either the compiler (I'm using Vala 0.7.5) is failing to enforce the protected access restriction, or the documentation is wrong.  In either case this should be fixed.