Webservers convention not to serve hidden files
RFC 5785 (/.well-known/) breaks this convention, but sure, you are right in general.