What kind of webserver do you have?
I know our htaccess will block access to any PHP file outside of the main index file or the ipn.php callback file.
Though I'm not sure if the NGINX config has been updated with the same treatment.
This reminds me that it's probably about time to revisit that config to see if improvements can be made.