Can I specify file associations at a more general or specific level?
I'm not certain about separating out password-protected PDFs specifically - it would depend on how they differentiated themselves to the OS, but everything else can be done with RCDefaultApp
which, though quite old, is still perfectly functional.
It adds itself as a control panel &amp; can then adjust defaults for any app &amp; protocol.