Thanks for the questions.
to send and receive IOTAs, one needs to create new addresses in the wallet and attach them to the tangle, correct?
Incorrect. the address doesn't need to be attached to the tangle in order to receive funds at that address. The process of sending a transaction does the PoW necessary to attach the address anyway.
as long as an address is NOT USED to SEND, it can be reused to RECEIVE IOTAs as often as one wishes (no security issue involved), correct?
Here's a quick explanation of how addresses work:https://matthewwinstonjohnson.gitbooks.io/iota-guide-and-faq/how-addresses-work.html
as soon as a single address is used to SEND, for security reasons it should not be used anymore to RECEIVE, let alone SEND IOTAs, correct?
Is there a possibility to "protect" a specific address within the wallet, so it cannot be (accidently) used to SEND IOTAs?
You could definitely write this into a custom wallet if you wanted this feature. Just program it to skip a certain index (or range of indices).
If this would be possible, one could create a single address to RECEIVE IOTAs (and publish this address generally), and create "SEND IOTA" addresses, whenever the need arises.
Read the link posted above that explains how addresses work. That might help you to clarify this question/understanding.
Hopefully that helps get you on the right track. Thanks for the questions.