Is this a problem in the /core-service=management/access=audit resource tree as well, or just in subsystem=logging?

Problem is only in subsystem=logging syslog-handler.

CLI commands and output:
/subsystem=logging/syslog-handler=syslog:add()
/subsystem=logging/syslog-handler=syslog:read-resource(recursive=true)
{
    "outcome" => "success",
    "result" => {
        "app-name" => undefined,
        "enabled" => true,
        "facility" => "user-level",
        "hostname" => undefined,
        "level" => "ALL",
        "port" => 514,
        "server-address" => "localhost",
        "syslog-format" => "RFC5424"
    }
}

There is no attribute for protocol.

This will not be done for EAP 6, but I will target EAP 7 for this. The current way in EAP 6 will be to use the syslog handler as a custom-handler.