Why is not flashing process protected by password? I would like to know why not manufacturers include a protection against flashing recovery or ROM under a password like IMEI, I mean, the devices should be protected via hardware to prevent against unwanted flashing process, IMHO.
Locked bootloaders are more secure than any password-based measures. Unlocked bootloaders will render any password-based measures useless.

Most if not all phones come with locked bootloaders by default, and the process of unlocking it isn't simple in most cases - it usually involves having physical access to device, being able to power it on (enter the OS) and having knowledge of ADB/fastboot. Some devices even make their bootloaders non-unlockable in the first place. If your OS is also protected well by PIN and/or fingerprint, the chances of breaking through are pretty minimal.