Private file folder outside document root
Looking at the code in system.install that raises this error it just checks if private://.htaccess exists:

$htaccess_files['private://.htaccess'] = [
    'title' =&gt; t('Private files directory'),
    'directory' =&gt; drupal_realpath('private://'),
];

...

foreach ($htaccess_files as $htaccess_file =&gt; $info) {
  // Check for the string which was added to the recommended .htaccess file
  // in the latest security update.
  if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) {
    $url = 'https://www.drupal.org/SA-CORE-2013-003';
    $requirements[$htaccess_file] = [
      'title' =&gt; $info['title'],
      'value' =&gt; t('Not fully protected'),
      'severity' =&gt; REQUIREMENT_ERROR,
      'description' =&gt; t('See &lt;a href=":url"&gt;@url&lt;/a&gt; for information about the recommended .htaccess file which should be added to the %directory directory to help protect against arbitrary code execution.', [':url' =&gt; $url, '@url' =&gt; $url, '%directory' =&gt; $info['directory']]),
    ];
  }
}


At no point does it check if your private file directly is actually inside webroot or not.

This means in your case it's a false warning and you can ignore it, as your right in saying there is no point putting an .htacess file to deny access in a folder outside of webroot.