Hi,
This is a new check in Matomo that checks if these files are accessible to any person on the internet (which they should not be).
So if you see this waning, this means that something in your webserver config is not blocking access as it should.
If you are using Apache, then Matomo creates .htaccess files that should block access, but maybe you have set up Apache to not allow .htaccess files (the option is AllowOverride).
If you use another webserver, you need to add these rules yourself and can take inspiration from matomo-nginx.