If Google refunds invalid clicks, why do I need click fraud protection?

Because a refund is retrospective and financial, while the damage is immediate and operational. The credit returns the money, but the click already consumed part of your daily budget, entered your analytics, and fed your bidding model a non-conversion. Protection works on timing rather than accounting: stopping the click from arriving in the first place, alongside Google's filtering rather than instead of it.