Why are public files in Joomla admin directory?
I have found the same thing. I think there is a misalignment in the configuration, as the components settings file:


 * CIVICRM_UF_BASEURL - home URL for your site:
 * Administration site:
 *      define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/administrator/');
 * Front-end site:
 *      define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/');
 *
 */
if (!defined('CIVICRM_UF_BASEURL')) {
  define( 'CIVICRM_UF_BASEURL'      , 'http://www.xyc.com');


For the front end forms to work, it needs to be /administrator to load the resources, however the form then posts to this URL, which is not correct for unauthenticated users.

I am going to copy the relevant resources for now.