Update -- Please see the comment below that links to a true explanation of protected/private in Ruby. That was a deep seated prejudice left over from my Java days, indeed. The only important part left to my answer is that controller methods that are not actions should not be public (or at least your routes should protect them).
Single Table Inheritance is a perfect example of when protected is helpful in the model tier, as it's one of the most common uses of inheritance there.
In the controller tier, helper methods defined on ApplicationController should be marked as protected -- if they were private the other controllers would not be able to access them, but if they are public Rails will treat them as actions.
Personally, I find that I use class inheritance more than many of my friends and coworkers, even in Rails applications. Because I use it often (and coming out of my Java days), I favor protected for all helper methods to give freedom to anyone (usually myself) who wants to extend the class -- unless I'm really really embarrassed about one, then I mark it private. :)