There is, of course, no technical way to find that file as long as you don't have any vulnerable services running on your system. Its not very likely that someone is searching for hidden files without a reason. But, of course, you should use .htaccess when you can.
In a typical scenario, attackers scan for webapps that are known to be vulnerable or allow a wide specturm of access to your system if bad or default passwords are used. This basically applies to all administrative web applications such as PHPMyAdmin, for example. Then they try to exploit the vulnerablity or to enter the webapp using default or common passwords.
If exploits/bruteforce fails or the server has already been hacked and "secured" by the previous hacker, it frequently happens that the attackers then uses a "shell scanner". Shell scanners are simple scripts that check your server for a given list of filenames. Those filenames are often the ones commonly used for webshells like the c99. This is the moment where it can happen that your hidden file is found. I can't think of any other scenario where someone starts searching for hidden files without a reason.