D8 doesn't create .htaccess for private file system path
This is a better .htaccess to use:

# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
&lt;Files *&gt;
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
&lt;/Files&gt;

# If we know how to do it safely, disable the PHP engine entirely.
&lt;IfModule mod_php5.c&gt;
  php_flag engine off
&lt;/IfModule&gt;
&lt;IfModule mod_php7.c&gt;
  php_flag engine off
&lt;/IfModule&gt;


This .htaccess is the one that should have been placed in your private files directory by Drupal 8 (or 9) core. (Perhaps permissions on the private directory prevented Drupal from creating the file.)

The accepted answer above is adequate to quiet the warning from Drupal status report, but does not actually prevent the remote script execution exploit addressed in the original core security advisory from 2013.