When I set

parent = Parent(...,ResourceOptions(protect=True))

then pulumi sets

protect=True

on all children as well

child = Resource(..., ResourceOptions(parent=parent)

- is this intentional or do I have any bug in my code?

dns_zone = aws.route53.Zone(
    "zone",
    force_destroy=False,
    name="<http://example.com|example.com>",
    opts=pulumi.ResourceOptions(protect=True),
)

# this is a Component Resource
cert = ACMCertificateR53(  
        cert_config=ACMCertificateR53Config(
            name=f"{PREFIX}-{key}",
            tags=DEFAULT_TAGS,
            zone_id=dns_zone.zone_id,
            domains=["*.<http://example.com|example.com>"],
        ),
        opts=pulumi.ResourceOptions(parent=dns_zone),
    )

I see it being documented here https://www.pulumi.com/docs/intro/concepts/resources/options/parent/ But why is the parent protection passed onto children? I want to protect parent resources only and not child resources.