Do we need hash in Config Sync Directory if outside root
The only purpose of the hash is to make it impossible to guess the location of the exported config. This is an additional access control in case .htaccess in the sync folder fails to do this.

If the config folder is outside of the root of the webserver you don't need the hash.