Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, but it's not a big difference if you have control of the system.
No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be accessible to other applications.
If you control the system, then you can do whatever you want, including just decrypting the section. There is no protection against the owner of the box.
The biggest protection that you get here is against the web.config file itself being leaked. If a malicious party gets a copy of the file, the sensitive data it contains can't be used to attack you if it is encrypted.