In 2507, Workspace App detection has been removed for App Protection for hybrid launch. Can anyone explain this change? It seems to me, that Citrix is lowering security, by doing this.

Versions of StoreFront earlier than 2507 attempted to detect the version of Citrix Workspace app installed using using Citrix web extensions or Citrix Workspace launcher and only displayed resources with App Protection if the client met certain minimum versions. However it was not possible to guarantee that the version was correctly detected which lead to resources being incorrectly shown or hidden. Therefore this check has been removed.

The check was removed as it could hide protected apps unnecessarily. The check in itself did not provide sufficient security as it was easy to bypass intentionally or unintentionally. The way to securely ensure app protection is enforced is to enable App Protection Posture Check and tampering detection.

I just upgraded to 2507, and the ressources are still hidden, after detection check. And since protocolHandler(aka No ica download) is enabled on Storefront. Would you say I'm good?

Resources with app protection are always hidden by default when using a web browser. You have to explicitly enable it: https://docs.citrix.com/en-us/storefront/current-release/stores/websites/app-protection