Is it okay to expose .yml or .install files to public? As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, theme, modules etc. But these directory contains some .yml or .install files e.g drupal/web/core/modules/user/user.install which gets downloaded automatically when someone visits my site example.com/core/modules/user/user.install .

So is it okay to expose those files to public ? and what steps can be taken to avoid it ? I checked some popular sites they also expose those files. So bit confused. 

Note: Drupal default .htaccess may take  care of these thing for Apache server only but what about other servers like nginx ? However I think Drupal is hard coded to be used with Apache server only.
No.

The web server (e.g. via apache's  directive) needs to be able to read (not write) the index.php file (and occasionally others such as update.php), and also static files such as .css/.js, pdfs and images.

The php interpreter is not limited by  directives and so most other files required by php do not have to be visible.

As Hudri said, leave the .htaccess files as they are, configure the server to notice them (AllowOverrides) and refer to an appropriate guide, such as:
https://www.drupal.org/docs/develop/local-server-setup/linux-development-environments/installing-php-mysql-and-apache-under