IBM's MVS Initialization and Tuning Reference manual, states in the chapter for SCHEDxx, under PPT:
The program specified on PGMNAME can bypass security protection (password protection and RACF). PASS indicates that security protection is in effect; NOPASS indicates that security protection is not required. PASS is the default.
Jobs that request the bypass-security-protection property will receive the property. ...
CA ACF2 does not honor NOPASS. Specifying NOPASS does not allow the program to bypass CA ACF2 security.