Just to be clear, "password protected page" is not strictly the same as "Google and nobody can ever see or access anything in this folder". X3 protects the X3- page, which under normal circumstances means that nobody (including Google) can "find" the images. How Google is "finding" your images when it can't access the page that is listing them, I don't know ... Perhaps this folder was not protected earlier? Do you have a an image reference link so I can have a look? Having said that, X3 does not BLOCK access to FILES that are in password-protected folders ... That would require a server-side protection setup using .htaccess to block access.
On a related note, you could block images from being indexed by Google in the first place, from Settings > Advanced > "Prevent search engines from indexing image pages".