https://wiki.mikrotik.com/wiki/Manual:RouterBOARD_settings#Protected_bootloader
This is a new feature which allows the protection of RouterOS configuration and files from a physical attacker by disabling etherboot. It is called “Protected RouterBOOT”. This feature can be enabled and disabled only from within RouterOS after login, i.e., there is no RouterBOOT setting to enable/disable this feature. These extra options appear only under certain conditions. When this setting is enabled – both the reset button and the reset pin-hole is disabled. Console access is also disabled. The only ability to change boot mode or RouterBOOT settings is through RouterOS. If you do not know the RouterOS password – only a complete format is possible.