As mentioned in T308008#7938800 the current status quo is the ProtectionFilter is making a SQL query for each task in the task set to know if it is protected or not. This could be improved to make a single query per task set instead.
See review comments in gerrit 793035 and T308008: Number of "found articles" is not matching the real number of articles for more context.