I've got a short update, since this happend at a customer after a HA Failover (which only partly worked, but that's a different story). I had to readd all Hosts by IP address and hadn't disabled HA before that, because time was short in this very moment. This process also produces the bug and you cannot eliminate it by disabling and enabling HA. The solution that worked for me, is:
1. Disable HA
2. Disconnect, but don't remove all ESX hosts.
3. Reenable HA on the Cluster
4. Reconnect all hosts, one by one.
5. The VMs will turn to protected after a minute or two.
Regards,
Pesché