I thought the way this worked is that protected members can be accessed in all cases where default members can be accessed (when the accessing member belongs to the same package) AND via a subclass through inheritance.
From the language specification, a few lines above where you linked:
... if the member or constructor is declared protected, then access is permitted only when one of the following is true:
- Access to the member or constructor occurs from within the package containing the class in which the protected member or constructor is declared.
- Access is correct as described in �6.6.2.