trashaccount As this commit says:
By default, Settings.{Global,Secure,System} that aren't annotated with @Readable are readable only by preinstalled apps (with some exceptions, see enforceSettingReadable()).
Settings.{Global,Secure} settings are writable only by apps that hold the privileged WRITE_SECURE_SETTINGS permission. Settings.System are also writable by apps that hold the WRITE_SETTINGS app-op permission (it's surfaced as "Modify system settings" in the UI).
This commit adds @Protected setting annotation, which allows to further restrict settings access
by specifying which system apps are allowed to read and/or write them.
Using this, they've restricted a lot of settings' visibility to apps that actually need to see the settings, and also restricted writes to the Settings app for many of them (I didn't look at all of them). They've also set immutable values for some settings that shouldn't be changed, for example false for features that are already disabled, like instant apps.
Here's an example for scrambled PIN layout. SystemUI can only read and Settings can read and write.