Let me rephrase: RadiusClient.getAuthProtocol() needs "eap-ttls" as parameter when wanting to use EAP-TTLS. So far so good. However, when I check what this.protocol.name() returns, it returns "EAP_TTLS" when I've specified "EAP_TTLS" in the deployer config.

RadiusClient will not be null when you specify an invalid protocol, it simply sets its internal authenticator to null. When you then attempt an authentication, then first few lines in RadiusClient.authenticate() fetches a PAPAuthenticator() when the authenticator is null...