I'm impressed. I didn't know you could even target MS Word with XSL-FO.
Or are you using XSL-FO? Your post first said "XSLT FO" and then just "XSLT". Are you really using XSLT to transform something into the WordML dialect of XML, or something like that? If that's the case, then you just have to go through the documentation for that XML dialect and find out what elements you use for password-protection.