See Help Center > Privileges > Cast close and reopen votes
It's the result of "close" votes being cast.
It takes 5 close votes to reach the closing threshold ...
Close votes age away harmlessly if the threshold is not reach after a number of days. ...
Once a question has been closed, it will no longer accept new answers and the words [on hold] will be appended to the title. After 5 days, if the question remains closed, the word [closed] will instead be appended to the title.
So "on hold" really means "this is going to be marked closed soon, unless you can convince people to re-open it". However it is still actually closed.
... any user with the "protect questions" privilege can put question on hold ...
No, that's different. I've protected a couple of questions which were intended as reference questions, when people were starting to "answer" with their own problems.
Right now, users with 500+ rep will have the "cast close and reopen votes" privilege, which is what is needed for voting to close.
Moderators can also lock questions and answers, like this rather amusing one in order to prevent people altering it.