If your site is properly setup, the .htaccess file forces a login first ...

This stops access to that directory to the files ...

Try it for yourself to make sure your site is secure ...