private static Map<String, Object> getTrustingConfig(CertStores certStores, CertStores peerCertStores, List<String> tlsProtocols) {
        Map<String, Object> configs = certStores.getTrustingConfig(peerCertStores);
        configs.putAll(sslConfig(tlsProtocols));
        return configs;
    }
<p>
The explanation of this check in the structure of the ClientHello SSL message.
Please, take a look at the <a href="https://docs.oracle.com/en/java/javase/11/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-4D421910-C36D-40A2-8BA2-7D42CCBED3C6">Guide</a>,
"Send ClientHello Message" section.
<p>
> Client version: For TLS 1.3, this has a fixed value, TLSv1.2; TLS 1.3 uses the extension supported_versions and not this field to negotiate protocol version
...
> supported_versions: Lists which versions of TLS the client supports. In particular, if the client
> requests TLS 1.3, then the client version field has the value TLSv1.2 and this extension
> contains the value TLSv1.3; if the client requests TLS 1.2, then the client version field has the
> value TLSv1.2 and this extension either doesn't exist or contains the value TLSv1.2 but not the value TLSv1.3.
<p>

This mean that TLSv1.3 client can fallback to TLSv1.2 but TLSv1.2 client can't change protocol to TLSv1.3.

@param serverProtocols Server protocols. Expected to be non empty.
@param clientProtocols Client protocols. Expected to be non empty.
@return {@code true} if client should be able to connect to the server.
clients/src/test/java/org/apache/kafka/common/network/SslVersionsTransportLayerTest.java