Function merge_protected_fields_defaults 

pub fn merge_protected_fields_defaults(
    configured: &mut ProtectedFieldsConfig,
    owner_exempt: bool,
)

Fold the defaults into a configured protectedFields, as upstream does at option-resolution time (ParseServer.ts:657-673).

A configured block adds to the defaults, it does not replace them. Assigning the parsed configuration straight onto the config is the obvious translation and it is a data exposure: a deployment that configures protection for one of its own classes and never mentions _User thereby unprotects email on every user, which the operator did not ask for and cannot see in their own configuration file.

Upstream’s rule, per class present in the defaults:

• the configuration does not name the class at all, so the default block is used whole;
• the configuration names it, so each default entity key is unioned into the configured one.

The single exception is protectedFieldsOwnerExempt == false, where a configured entity key is left exactly as written. That option means “apply protectedFields to the owner the same as to anyone else”, and merging a default the operator did not write would undo the point of setting it.