Update STM32 with read out protection level 1 over UART
Assuming you mean built-in bootloader it is described in AN3155. Section 3.12 clearly states what you can disable RDP (read-out protection) by sending specific command. It will erase all flash memory contents as usual. So basically yes, you can clearly update your firmware over the built-in UART bootloader even with RDP enabled.
As for your 2nd questions - to provide security during updates you have to implement your own software bootloader on the STM32. Which will at least accept encrypted firmware. You can also add more security by implementing cryptographic authentication of some sort. Specific implementation will depend on your uC series. ST Micro offers some solutions on their own software and there some interesting open source secure bootloaders over the Internet you can use as a base for your own.