Here is what I found in make.globals after in a fresh prefix CONFIG_PROTECT="/etc" CONFIG_PROTECT_MASK="/etc/env.d"
Do you have proof that it DOES NOT work as you think it should? If so, that would be news to me (and a regression) (There is magic behind the scenes so that CONFIG_PROTECT doesn't need to be prefixed)
Sorry for bothering then. Most options containing a path have prefix, except this one. A comment in the file would clear things.
CONFIG_PROTECT is on purpose not prefixed, because it is defined in the profiles, and hence cannot contain the right prefix. I'll add a comment. Thanks.