I may have a clue on this, or at least a piece of one. My EFI BIOS (or whatever the proper term for it is) has a legacy-MBR mode. The way it decides whether to engage that mode is whether any partitions are marked active. If one is, it executes the MBR; if none are, it demands a GPT partition table to boot from. This seems like it may be related to why the spec forbids marking the protective partition active. If this _is_ the reason, it suggests that it should be safe to mark the protective partition active, as long as the dummy MBR knows how to boot the system anyway, should we find ourselves executing it by mistake on an EFI system.