...

Does that mean that protected (not protected var) parameters are passed by value? Especially in the case of large structures, can this be inefficient, taking up stack space and consuming time to copy the arguments?

Yes. :-(

...

Or does the standard prescribe something different?

Yes. It requires that the value of the protected formal parameter cannot change during the execution of the function,

The standard doesn't define it this way. I too think that protected should be treated exactly like var parameters, or whatever is as efficient or more efficient (that's why I use const parameters for in Borland Delphi).

The standard says this about protected parameters: