When I write my own htaccess file, it goes to 404 also, but think I’ve figured it out.
When the pretty permalinks are on in the main blog, the password protect option goes to 404. When they are off in the main blog, password protect works fine.
It doesn’t matter how the sub-blog permalinks are set. Works either way.