I just wasted god knows how much of my life working out why a .htaccess file was viewable from a web browser... even if the directives to hide itself were set within itself!
Turns out the <Location> block in a virtualhost was overriding the permissions.
I was nearly tearing my hair out.
Thanks for listening.