Does click fraud protection work with Performance Max?

Not in the same way. Performance Max does not support IP exclusions, so the mechanism that prevents an ad being shown to a flagged address has nothing to act on. A protection tool can still record and report the traffic reaching your site from PMax, which is useful for spotting patterns, but it cannot stop the clicks being served. Any vendor claiming otherwise is worth questioning.