Is POR Secure Memory/peripherals on ARM common in real hardware just a feature of QEMU?
I am less familiar with the software side of things or QEMU, but I have dropped a number of ARM cores on silicon. 

It is possible in hardware to check the AXI bus protection bits prot[2:0] and refuse access if cycle does not have enough rights or is of the wrong type. 

Here is an abstract of the AXI standard:


  Normal or privileged, ARPROT[0] and AWPROT[0]
  • LOW indicates a normal access
  • HIGH indicates a privileged access.
  This is used by some masters to indicate their processing mode. A 
  privileged processing mode typically has a greater level of access within 
  a system.
  
  Secure or non-secure, ARPROT[1] and AWPROT[1]
  • LOW indicates a secure access
  • HIGH indicates a non-secure access.
  This is used in systems where a greater degree of differentiation between 
  processing modes is required.
  
  Note
    This bit is configured so that when it is HIGH then the transaction is 
  considered non-secure and when LOW, the transaction is considered as 
  secure.
  
  Instruction or data, ARPROT[2] and AWPROT[2]
  • LOW indicates a data access
  • HIGH indicates an instruction access.
  This bit gives an indication if the transaction is an instruction or a data 
  access.
  Note
    This indication is provided as a hint and is not accurate in all cases. For 
  example, where a transaction contains a mix of instruction and data 
  items. It is recommended that, by default, an access is marked as a data 
  access unless it is specifically known to be an instruction access.


A prime example would be an en/decryption block which can only be access in privileged, secure, data mode PROT[2:0] = 3'b001

Note that this would be a feature of the system as the protection is build using the logic which does the address decoding, all of which is outside the processor core.