How does $allowedFields protect against mass assignment vulnerabilities?

I thought I understood $allowedFields until recently, when I tried to insert a field not listed by assigning it manually to my entity.
Turns out that it is discarded, even though I assigned it manually, ej:

PHP Code:

$obj->protectedField = 'value'; 


and then

PHP Code:

$objModel->insert($obj); 


It seems that I can't set any field unless it's on the $allowedFields list. This will only protect fields that are automatically handled by the database or inserted bypassing $allowedFields.

Could you please clarify whether I've misunderstood or if there's something I'm missing?