I hired someone to do SEO work on my website. He started by creating free profiles on dozens of sites that have nothing to do with my business. For example, evernote.com, penzu.com, pearltrees.com, diigo.com, ello.co, livejournal.com, myspace.com, etc... I think the idea was to get backlinks. However, only a few of these sites provide dofollow links and I think Google would be smart enough to know that these are not quality backlinks. He says he is following protocol and only uses "whitehat" techniques. Should I be concerned?
Yes. You should be concerned. Links from sites which do not relate to your content are likely to decrease your SEO performance. I am not very familiar with many of the sites he listed, and it is likely legitimate for him to host your profile in appropriate sites/directories (but it sounds like the appropriate bit is missing from his endeavours.) If you are a maker/creative and are trying to promote a website focused on creative endeavors it is possible that what he is doing is appropriate, but it seems somewhat unlikely.
"following protocol" sounds rather hollow to me - I am unaware of any "protocol" which applies to SEO, although there are certainly best practices. None of these were named in your post!
I do not hold myself out as being an SEO expert, but I've been around long enough to know that SEO is about ensuring you have the appropriate content on a "clean" site - with appropriate keywords (but not using keyword stuffing), having backlinks from credible, related sources, and doing things like GMB, using appropriate schema and taking whatever steps you can to make your site a credible, authorative source of information.
I did want to point out that nothing described would be considered "blackhat", so its not likely to get you blocked from Google - it just sounds like someone who does not know what they are doing following a 15 year old playbook which is obsolete.