Then you should contact your host because a browser viewable .htaccess file should never happen.
It'll be something to do with apache config or the web server's config.
It means that the .htaccess file hasn't got the right settings in the web server and the web server doesn't know that the file needs to remain private.