In 2014 I was able to bypass .htaccess restrictions of a site hosted on Namecheap using social engineering through the live chat... Twice.

All I had to do was tell the chat operator I was having some issue with .htaccess and .htpasswd until they offered to delete it temporarily. In the few minutes between them deleting it and reuploading it, you're free to do whatever you want.

I reported this and was told it was resolved (I guess with new policies).