It would require a change to the protocol

Its both. They won't create more for philosophical reasons because the value would plummet. They won't create more for technical reasons because it needs an 80% majority of nodes to approve a change for it to occur.

Some people will tell you they control the validating nodes, but thats only really a half truth. Ripple controls 3 out of 50+ nodes, and also controls the default list of approved validator nodes. There's no reason why you can't deviate from the default list of validators, but its hard to say if anyone actually does in practice.