Yes, returning multiple <Protocol> elements inside <Account> is explicitly allowed by the Autodiscover schema (MS-OXDSCLI). It's actually the normal case — you almost always need at least an incoming protocol plus SMTP for sending.
What works well in practice:

IMAP + SMTP (or POP3 + SMTP) — standard and universally supported. Outlook, Apple Mail, Thunderbird-style clients all handle this fine.
EXCH + EXPR + WEB — the classic Exchange combo: MAPI/RPC internally, RPC-over-HTTP externally, plus OWA/EWS URLs in the WEB block.
EXCH/EXPR + EWS endpoints — EWS is typically advertised via the <ASUrl>/<EwsUrl> elements inside the Exchange protocol blocks, not as a separate Type="EWS" (there is no such type; EWS lives inside EXCH/EXPR or under WEB).

Where it gets messy:
Mixing Exchange-style protocols (EXCH/EXPR) with internet-style ones (IMAP/POP3) in the same <Account> is where clients disagree. Outlook generally picks the Exchange protocol and ignores the IMAP block — it doesn't treat them as a fallback chain in the way you might hope. Some third-party clients will get confused or pick the "wrong" one. If you actually want a client to choose IMAP, don't advertise EXCH/EXPR alongside it.

Also worth noting: Autodiscover allows redirect responses (<Action>redirectAddr</Action> or redirectUrl) and <AlternativeAccount> blocks if you need to express "use this server for IMAP, this other one for SMTP under a different identity" — but for a single mailbox served by both IMAP and SMTP, just two <Protocol> blocks in the same <Account> is the right shape.
So: multiple protocols — yes, valid and expected. Just be deliberate about which combinations you ship, because some clients treat the list as "pick one" rather than "use all."