Hi!
I was able to reproduce the issue on a test subdomain-based multisite. Password Protection is working for the main site of the instance, but other sites are ignored. At the same time, I checked that the feature works for subdirectory-based instances.
The bug in WordPress toolkit was...