Well, from what I saw digging around it looked like just a small change to the mutate_content action file, and a more difficult one to the save_content processor.
The permission check staring at line 14 of mutate_content changed to
case 4:
if (!$modx->hasPermission('new_document')) {
$e->setError(3);
$e->dumpError();
}
break;
takes care of the "can’t do it if the parent doc is secured" problem. This would need to be adjusted some to deal with "can’t add new resources to top-level (parent == 0), but the main idea is here.
The saving part comes in a block starting on line 252; it needs to be modified to only block if $actionToTake == ’edit’ or $udperms->document (the parent ID) == 0 and the user can’t put new resources in the root.
I didn’t really go into that, as I was uncertain as to why this blanket prohibition on putting new content in a protected container was set up in the first place; I may be missing something crucial here.
Anyway, changing those two files should open up the "new" option even if the container is protected.