This may be an STM32-specific thing, and not related to Segger BUT:

I enabled read protection on a STM32L496AG part.

When I connect with:

And then do "halt",
sure enough, I am presented with the dialog about "Active read protected STM32 device detected."

But if I select "no", and DON'T trigger a mass erase, it drops to the "J-Link>" prompt,
and I can then do:


and it reads out the flash memory. SP, vector table, etc.

Which is ... surprising?

Okey dokey, apparently the problem is the JLink has to be disconnected and then reconnected, too, otherwise it (apparently) can keep the TAP open and bypass RDP, even through the device doing a Flash Option Bytes programming sequence.

Resolved now.