How are sensitive .php files protected?

[.m.]

IMO, there is no need to worry about it as php files are not sent directly to browsers. they are first executed by web server.

you have already seen that config.php file is not accessible through your browser.

yet, if you want to take precautions then please see Security Tutorials & search results on Google