Public custom settings included as part of a managed package can be maintained by users of the target org if they have the Customize Application permission, which seems somewhat heavy handed, but it does work.
Protected custom settings are completely hidden, and can not be accessed via the GUI or via Apex; given that any records in the custom setting are not included in the package (i.e. it's empty in the target org). They could me modified and accessed via code in the managed package, so you could use them to store some dynamic values as determined by a user of your code/page.
If I wanted to use a list-type custom setting in a managed package in one of the most common use cases (i.e. storing a list of values I want cached, such as state codes) does this mean the only way to do so would be to check if there are any values there, insert a list if not, and then read them?
The insert would only happen the very first time and after that the caching would be efficient, but it seems like a bit of a work around for when you just want a static list—you might as well just use a static array inside a class.