BentoBox has protections for both: inside player island and outside player island.
Inside player island, players can change them by themself using /[player_cmd] settings. Outside player island only admins can change protections using /[admin_cmd] settings.
If you are not sure which flag prevents player action, you can always use /[admin_cmd] why <player> as that command will notify in chat which flag prevented action.