the default branch (master, main, or let’s just say the HEAD reference) is protected by default in GitLab by GitLab itsself on creation of the repository or the first push to an empty repository. See Protected Branches
If you host your own gitlab instance you could find out who personally protected a branch if you look into the logs who did a POST to /<full-project-path>/-/protected_branches. E.g. /mygroup/mysubgroup/myproject/-/protected_branches.
I have not seen this information avaliable in the WEB-UI yet.