It depends on the type of the webserver in question.
If it's apache, it should contain something like this in the config file (usually in the "main" apache.conf):
<Files ~ "^\.ht">
Order allow,deny
Deny from all
Satisfy all
</Files>
If it's missing, that can cause the problem you described.
The other typical cause of this is that the client have used apache in the past, but switched to something else (e.g. nginx) which does not use .htaccess and hence doesn't treat it in a special way. The solution in this case is webserver-specific, but it usually boils down to restricting access to files beginning with ".ht", or - if they are really not used - you can simply delete them.
.htpasswd
though – PlasmaHH Sep 16 '15 at 14:07