tp_base_connection_manager_register does:

  if (cls->protocol_params != NULL)
    {
      for (i = 0; cls->protocol_params[i].name != NULL; i++)
        {
          tp_base_connection_manager_add_protocol (self,
              _tp_legacy_protocol_new (self, cls->protocol_params + i));
        }
    }

and add_protocol does:

  g_hash_table_insert (self->priv->protocols,
      g_strdup (tp_base_protocol_get_name (protocol)),
      g_object_ref (protocol));

and obviously, there is just one unref in total, from the value destructor specified when creating the protocols hash table. I guess the protocol object can't be made GInitiallyUnowned; just unref the protocol manually using a temp var in register()?