I have had reports from players of them raiding bases that have no protection because they team are online, but some doors will have 100% protection. How and why is this possible? Is it because the person who placed the door is offline and those who are online aren't authed on it?

Is there some way to stop this happening?

its because the door owner is not on the clan with the online team.. To prevent this on my server, I prevent code locks and share key locks with team so that if anyone who can open the door is online its unprotected. If you use code locks this can be exploited as the builder doenst need to be authed on the tc so its possible to use a smurf account to make the base or parts of the base. The hard part when you enable code locks is the plugin doesnt know if the "guest" is here to raid or squat. I know its not a great news but I havent found a better way yet if code locks are enabled.