/usr/lib/gnupg2/gpg-protect-tool is in gnupg-agent 2.1.18-8~deb9u4.
This file is owned by root:root, with mode 0o777.
It is a symlink to /usr/lib/gnupg2/../gnupg/gpg-protect-tool
/usr/lib/gnupg2/../gnupg/gpg-protect-tool