[SOLVED] Readout protection doesn't actually protect from readout?

This may be an STM32-specific thing, and not related to Segger BUT:

I enabled read protection on a STM32L496AG part.

When I connect with:

JLinkExe -device STM32L496ag -if swd -speed auto

And then do "halt",
sure enough, I am presented with the dialog about "Active read protected STM32 device detected."

But if I select "no", and DON'T trigger a mass erase, it drops to the "J-Link>" prompt,
and I can then do:

mem32 0x08000000,32

and it reads out the flash memory. SP, vector table, etc.

Which is ... surprising?

Okey dokey, apparently the problem is the JLink has to be disconnected and then reconnected, too, otherwise it (apparently) can keep the TAP open and bypass RDP, even through the device doing a Flash Option Bytes programming sequence.

Resolved now.