Protocols tend to be a good first step, but they're extremely vulnerable to abuse without something larger working atop them.

Email is a protocol. Implementation is a practical nightmare because of bad actors. Something to control bad actors is vital to any communications system, regardless of whether you classify it as "service" or "protocol."