Using System.Security.Cryptography.ProtectedData, do you see any issue with encryption and encoding?
Your code is correct. I usually use Encoding.UTF8 because it is more compact for typical character sets.
SecureString is kind of a useless class. It is meant to never keep a secret unencrypted even in memory. This would only help if an attacker could read your processes memory. If he can do that you have lost already because he can read every character of your password the moment you use it or add it to the SecureString. Anyway, what attack scenario on earth allows an attacker to read your webserver process memory and not do other more dangerous things at the same time? In that case your box is probably compromised entirely. So you are right not using this class.