Are the cpu protection rings meant to protect against malicious programs, or against unintentional programming mistakes?
CPU protection rings are meant to enable operating system software the control and protection checks necessary to implement an overall security strategy with good performance. This includes the notion of kernel mode vs. user mode. (Multiple rings are useful so that one operating system can efficiently guest host/run (an)other operating system(s), instead of only user programs.)
I don't think that the CPU protection rings are meant to protect against malicious programs, because a malicious program can be written to run in kernel mode instead of user mode
You would still have to find an exploit that would trick the overall hardware/software system into running the program in kernel mode. An operating system would be remiss in allowing an unknown program (from the internet or otherwise) to run in the most privileged ring, regardless of where that code might have wanted to run.
(it can be written as a device driver for example) and then it will be able to cause whatever damage it wants.
Yes, if you could trick the system into loading your device driver, you'd have a lot of control. Bootkits do similar, they bypass security by placing files early in the boot process, so that those run before the operating system has a chance to come up and protect things (then further, they hide themselves from prying eyes).
This an aspect of why permissions are so important. A user mode program with unlimited permission can write to the file system in areas that will cause the operating system to load device drivers or the boot mechanism to load a bootkit.
I rather think that the CPU protection rings are meant to protect against unintentional programming mistakes, for example a programmer may unintentionally write code to access the memory of another process or the memory of the kernel, but since the program will run in user mode, the program will not be able to access the memory of another process or the memory of the kernel.
Kernel mode, for example, can reprogram the hardware's virtual memory protection and mapping mechanism, and this allows an operating system to establish separate address spaces for user mode processes. User mode, however, cannot make changes to the address space. Yet, the hardware CPU cannot remember everything needed to maintain an address space, so when it runs into something it doesn't know about, it faults back into kernel mode asking the operating system software to take over — the OS then decides if this is an illegal access (e.g. at kernel memory, or some other process or shared library) or if this is a legal access that the CPU didn't fully know about this go around (this is how page faults work in virtual memory).
Ultimately, security is accomplished by a complex choreography between hardware and (operating system or privileged) software. The hardware does simple (and a few complex) things that it can be programmed to do and that it can do rather quickly (perhaps in parallel with other computing), and anything that either doesn't fit inside the CPU or is overly complex is left for software. Software then makes use of the hardware features constantly changing and reprogramming the hardware as needed to run different programs or even different parts of the same program, while preventing the program from coloring outside of the lines.