Allow once / Deny once is not really a state. It is the same as a file not existing on the list at all, and you will be asked. PROTECTION and SECURITY are not related. If you BLOCK something from running, its protection status has nothing to do with it - it will be blocked from running !
Sorry tonyjl, my mistake. Gavin is absolutely correct. I was getting mixed up with another scenario where a program that was not on my security list but was on my protection list ran without alerting me.