Anyone can view the robots.txt file. If you include a private file they will also be able to view it by folloiwng the correct url. They can also view the directory if no index file is set.
Using SSI this simple includes the file into the source code, so they don't even have to follow the URL, it's all in the page. There are ways to protect your code, but some sad kid with no friends and lots of spots will always hack through it.