I'm glad I found this thread. I'm having the exact same problem, and thought it was due to the 2.9.x upgrade, but I guess it goes back to 2.7. If I password protect a post (using the same password as previous protected posts), the previous protected posts will show up even without a password (though "Protected:" is still in the title).
And then when I go back to those old password protected posts, and just hit update without editing anything (not even the password), then the most recent protected post will display without a password.
I've tested this across multiple browsers and operating systems, and it doesn't seem to be an issue with the cookies. It's as if one password will somehow reset flags for other protected entries.
Please help! This is very scary.