It is strongly recommended that you protect this directory in which admin tools installed for example with HTTP-AUTH (in a .htaccess-file).

By default, it is not protected in any way!
It shouldn't be readable by anyone and especially not by your clients.