Our site is password protected/paywalled. Does this mean the search engines cannot get to the thousands of pages behind the password protection?

That’s correct. If you want those pages in Google’s index, then you’ll need to allow Googlebot access to the pages without requiring log-in or cookies. To do this, you’ll need to use the Schema.org paywalled structured data element to ensure that Google parses your paywalled or subscription content correctly.