.htacess files are not supposed to load in the browser by direct access. They control the behavior of requests for assets within the folder. So of course going to www.mysite.com.au/sitemap/.htaccess gets you a 403 error
Code:
# deny *everything*
<FilesMatch ".*">
Order Allow,Deny
Deny from all
</FilesMatch>
# but now allow just *certain* necessary files:
<FilesMatch ".*\.(xml|xml\.gz)$" >
Order Allow,Deny
Allow from all
</FilesMatch>
Those rules only allow .XML or .xml.gz files to be accessed with in that folder, that's it, its only purpose