How could a .htaccess with authentication suddenly appear or change?

Question

This is not a feature of any known process. The automatic updater (currently) does not do this.

The updater does this neither explicitly in an attempt to update security, nor does it leave a mess like this behind if an update fails. This is pure user-error¹, or at least a user-land change.

^{1: or, in this case, a parnaoid host-provider combined with lack-of-communication.}