The “protected area” was probably reserved for DRM keys for video distribution, an envisioned use case that never took off for SD cards, and hasn’t been relevant for at least a decade.
https://www.sdcard.org/developers/sd-standard-overview/conte...
https://www.sdcard.org/developers/sd-standard-overview/conte...
However you can see from the parent comment:
> Success of mutual authentication enables host to access card protected area.
So it's something the memory control must make available after a handshake, and then I presume either some specific memory address or set of retrieval commands would follow.
As you mention, it also states this spec is now optional.