Here's what I don't understand: either you need to modify it within its own package (so you can use package-private to prevent anyone else from accessing it) or you have to leave it available for potentially anyone to modify, as you already are when you make it protected (hence: public). To be clear, I understand why people want protected. I'm just not sure it's strictly necessary from a permissions / invariants standpoint.

(Conversely, your scenario can be precisely solved without violating encapsulation by passing in step2 as a function, and passing in any information it requires as parameters. I suspect most of the usecases for protected go away with first-class functions).