If all the access is via SSL, then it's reasonably secure.
Basic authentication without SSL only sends the username/password as base64 encoded - so it's trivial to extract the tokens via MITM or sniffing.
Digest authentication without SSL is a lot better (a challenge based mechanism) but still not as secure as an encrypted connection. However there are few cues to the user that the authentication is being implemented as Digest rather than Basic. Also proxy authentication challenges look very similar.
The built-in authentication mechanisms don't provide for a good user experience. If this is for a site with a small, defined user group, then using the built-in methods are a quick solution (but you might consider client-side certificate auth instead). But for a public facing website you should think about implementing somethnig a bit more sophisticated.
You should configure your webserver appropriately to prevent direct access to the htaccess file and password database. Either by putting the config outside of the document root (obviously this isn't going to work for htaccess files - but they are just a local extension to the webserver config) or by blocking access to the files. Every Apache distribution I've ever come across blocks access to files with names starting '.ht'
While you can prevent direct access to the password db, there's not a great deal of scope for limiting brute force attacks on the server over HTTP - another reason for considering a forms based approach.