Use STM32CubeProgrammer instead of DfuSe that have also CLI to remove read-out protection and upload new firmware.
STM32 microcontroller reads boot pin at start-up to start bootloader. If you have USB it will start DFU. Remember that with removing read-out protection the microcontroller will restart - it will again test boot pin to come back to bootloader.
Figure 41 on page 47/93 of User manual UM2237 STM32CubeProgrammer software description shows CLI commands.
Removing read protection
To remove read-out protection use (section 3.2.15 in UM2237)
STM32_Programmer_CLI -c port=usb1 -rdu
here keep boot pin on vcc to come back into bootloader (get back DFU).
uC is now unprotected and erased!
-rdu option Remove memory's Read Protection by shifting the RDP level from level 1 to level 0.
Writing/downloading new firmware and verification
STM32_Programmer_CLI -c port=usb1 -w "firmware.elf" –verify
or .hex or whatever you have, STM32_Programmer will figure it out.
Setting read protection
You can also back protect uC by setting RDU in optionByte (section 3.2.17 in UM2237)
test option bytes ability with:
STM32_Programmer_CLI -c port=usb1 -ob displ
than use option byte name for setting protection level as you need
STM32_Programmer_CLI -c port=usb1 -ob rdp=0xBB
Carefull!! Level 2 read protection will lock your stm32 uC!
Chech documentation for your uC, usualy 0xCC is level 2 protection, 0xBB is level 1 protection and 0xAA and others is level 0 protection (unrotected).