Protect CPE form hardreset

Wrong. As normis wrote in this post “Exactly or More seconds will result the same - reformat NAND and Etherboot mode; netinstall will fix the device in any case”. I.e. you don’t have to hold the reset button exactly the configured number of seconds, holding it (arbitrarily) longer will have the same result.

The purpose of protected RouterBOOT is to protect configuration of your device from unauthorized access, not the device itself. Please read thorough this thread, it explains everything.