At the moment, protected Flow pages allow you to type out your comment, and only throw an exception when you hit 'submit'. To avoid wasted effort they should warn you earlier than that (say, when you open the comments box?)
See also: T91722: Says "user is blocked" when page is protected