>>My question is, if parameter service/protectedwebmethods does not appear in any profile file, how do I know what the value is set to? Or does that simply mean it's not set to anything?<<
As far as I know if the parameter service/protectedwebmethods is not set then the default security level of the web services will be taken into account and the default value depends on the kernel release. You basically change the behaviour by setting the service/protectedwebmethods with a value or a combination of values.
Check these SAP notes
1439348 - Extended security settings for sapstartsrv
927637 - Web service authentication in sapstartsrv as of Release 7.00
Cheers
Reagan