I was confused because it didn't work since I upgraded nginx to 1.20.2(or 1.21.5-quic in other server) from 1.19.4 with all the *.conf same. But, I found it's already discussed in the ticket #2101, #2071 (thanks Maxim).
ssl_protocols should be in http{} or in server{} with "default_server" since 1.19.6+.
Now, I did quick test again with 1.21.5 with BoringSSL(current version as of today). Result: ssl_protocols in default server{} block works. ssl_protocols in non-default server{} block doesn't work.
If this is the permanent case, updating the documentation may help us. For example, http://nginx.org/en/docs/http/configuring_https_servers.html.
Thanks.