@TomJNowell The parent .htaccess has some rewrite rules, but no passwd rules.
Without the sub-directory .htaccess, a direct URL request returns the image/pdf.
With the sub-directory .htaccess, wordpress returns a html page "Sorry, could not find".
Which is weird and confusing. Eh, the fake 404 html response will do for the moment.