Can anyone confirm that the

Web Site Hosting Files

directory is inaccessible by all roles except Admin in both SDF and UI unless you have SuiteCommerce enabled?