How can we control the PDF that is generated out of Doc designer in terms of it being locked?

We have 2 sites that have been aroud since the BigMachines days. We don't have the context as to why they are setup the way they are and I am not finding any documentation on this so I am hopeful someone has some info.

My question is really about best practice of how to Lock the PDF that is generated from the Doc Designer. Our requirement is that it should be password protected to be unlocked for editng

On one of our sites, it is somehow setup like this and works how we want without us having to do anyting.

On our site we have to ask Support to reapply a security patch after each upgrade/maintainace as the document is unlocked after those activities.