Regarding "blocking access from browser to the cache", wouldn't it be better if we provided a .htaccess that does that?

There are also other web servers then Apache :-). Also Apache is often configured not to process .htaccess files, that's why we have removed them some time ago...

Yes, I am aware. It's just Apache has quite a big market share. Anyway, since the other ones were removed I see no point in introducing them again.

Problem was that our documentation has relied on working .htaccess files. Maybe it would make sense to ship them, but still cover this topic in the documentation to cover users where .htaccess is not working. On the other side enabling .htaccess is generally not recommended by Apache docs....

When looking at this, I've realized that it might be better to just use existing TempDir for twig cache and we have already quite good docs on that...