It depends on the type of the webserver in question.
If it's apache, it should contain something like this in the config file (usually in the "main" apache.conf):
<Files ~ "^\.ht">
Deny from all
If it's missing, that can cause the problem you described.
The other typical cause of this is that the client have used apache in the past, but switched to something else (e.g. nginx) which does not use .htaccess and hence doesn't treat it in a special way. The solution in this case is webserver-specific, but it usually boils down to restricting access to files beginning with ".ht", or - if they are really not used - you can simply delete them.