The CiviCRM debug log should not be downloadable - generated .htaccess seems ok
It's possible that the config for the virtual host/Directory does not allow .htaccess override for the Limit directive type, and so is ignoring the Order commands.

See https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride