Even if protected-routerboot is enabled, it is still possible to do a recovery, according to RouterBOARD documentation: https://help.mikrotik.com/docs/display/ROS/RouterBOARD.
As an emergency recovery option, it is possible to reset everything by pressing the button at power-on for longer than reformat-hold-button time, but less than reformat-hold-button-max (new in RouterBOOT 3.38.3).
When you use the button for a complete reset, the following actions are taken:
EXTREMELY DANGEROUS. > Use this only if you have lost all access to the device.
- RouterOS, all of its files and configuration is completely and irreversibly erased by nand re-format;
- All RouterBOOT settings are reset to defaults;
- Board is rebooted;
- As boot from NAND fails, it goes to etherboot automatically;
- Netinstall is required to reinstall RouterOS.
Please note! Reformat on some RouterBOARDS can take more than 5 minutes. After formatting the board will be ready for Netinstall.