Well a 'protocol' is basically a windows plugin rather than a browser one, it's not more secure in any way. The difference is steam doesn't let you write steam://&lt;path_to_exe&gt; to launch any file.

It is a bit shady to install one without asking, but it's not difficult.