I agree that it's an edge case; I disagree that it shouldn't inspire much worry. It's not intuitive that "only those you approve" means "people whose follower requests you have approved since you went protected, plus everyone who was following you before then, regardless of whether you follow them back". The three or four people I've mentioned this to in person were all surprised by that behavior, anyway.
(Full disclosure: I'm elsewhere.org.)