Why is not flashing process protected by password?

Locked bootloaders are more secure than any password-based measures. Unlocked bootloaders will render any password-based measures useless.

Most if not all phones come with locked bootloaders by default, and the process of unlocking it isn't simple in most cases - it usually involves having physical access to device, being able to power it on (enter the OS) and having knowledge of ADB/fastboot. Some devices even make their bootloaders non-unlockable in the first place. If your OS is also protected well by PIN and/or fingerprint, the chances of breaking through are pretty minimal.