Those protected apps aren't secure at all. These protects are meant for girlfriends only... :)
As you've said Android doesn't allow one app to prevent another app from starting up, there's no way to really protect an app.
The password screen can be by-passed by disabling one receiver of protector app. Even its also not required for some poorly written protector apps: Just, kill the protector app and done! And, the most easiest method is more funny: Many protector apps provide a failsafe password to by-pass protection in case user has forgotten the password. You just need to contact developer saying you have forgotten your password & he'll provide you a failsafe password. :)
If your device is rooted, I recommend you to use Seal. Seal provides a root method which is much more secure than generic methods. Disabling a receiver doesn't by-pass its security. As it gets root permission, it heal itself from any attempt to by-pass its security. So, even malicious codes fail against it.
In the last, no protector app encrypts an app & decrypts it on fly before opening it. Its simply because Android system simply doesn't support it. So, an advanced user can access your protected apps & associated data using Android SDK.
