After reading the content in the Trailhead unit noted in title I was surprised that my last choice (due to process of elimination) to question 2 was the correct choice - the answer was "B - Only the subscriber can edit the fields"???  Everything I was reading suggested (particularly the chart) indicates that only the package developer can edit the fields.

Is this an error or did I miss some important content?   Are subscribers allowed to edit fields for protected records if they are designated upgradeable?

2. Both fields on the VAT Data type are upgradable. If your records are protected, who can edit these fields after they’re uploaded and installed in an unmanaged package?
  A Only the package developer can edit the fields.
  B Only the subscriber can edit the fields.
  C Both the developer and the subscriber can edit the fields.
  D Nobody can edit the fields because–they’re locked after release.

Supporting excerpts follow...

Putting it all together
In a managed package, the package developer can always edit upgradeable fields. Subscribers can edit subscriber editable fields on public records but not on protected ones. In fact, subscriber editable fields on protected records are essentially locked after release.

Protecting Custom Metadata Records
Instead of protecting the entire metadata type, you can leave the type public and protect individual records. A protected record is only accessible to code in the same namespace as the record or its associated custom metadata type. But because the type is public, a subscriber org or extension package can add its own records to that type.

Field Manageability
Upgradeable—The package developer can edit the field after release via package upgrades. Subscriber orgs can’t change the field.