Can I protect files, images and PDF's attached to protected categories?
If you're using the WooCommerce Protected Categories or Password Protected Categories plugins, then they will protect your category pages and all the products/posts within these protected categories. The plugins will not protect any Media Library files that are linked to your protected content, such as featured images or downloadable PDF files.
The files will be accessible to anyone who has the direct link to the image in your media library. However, if they only appear on products or posts that are in a protected category, then it's unlikely that any unauthorized visitors will ever get the link. For added security, you could also check whether your SEO plugin allows you to noindex specific images, just in case.
If your documents are in Document Library Pro
Document Library Pro protects its own files, so you don't need anything else for those. Tick 'Protect media files' under Documents → Settings → Access Control on the Advanced plan. The files attached to your protected documents then move into a private folder that the web server won't serve. See protecting your document library for the full setup.
If you're protecting other post types
For products, posts, pages or anything else outside a document library, use Prevent Direct Access alongside WooCommerce Protected Categories or Password Protected Categories. It lets you restrict access to your media files for logged in users, specific user roles, and so on.
Please note that this works best with the user role protection option in WooCommerce Protected Categories and Password Protected Categories. This is because you can restrict the media files so that they are available to the same user role as your protected categories. When they log into their user account with the correct role, both the protected category AND the attached media files will be unlocked at the same time.
You can use Prevent Direct Access with categories that you protect using a simple password. This will not automatically unlock the media files, so you will need to think more carefully about the user journey when they unlock your protected content.