I was attempting to lock down our Joomla admin folder with an additional Apache-level password, and discovered that there are some Civi resources under the admin folder that need public access (css, js, etc.). On the face of it, it seems to me this would be a bad practice (other public joomla resources do not seem to be under admin), but there are vast oceans of information that I don't know! Could someone explain (as briefly and simply as possible!) why these files are under www/administrator/components/com_civicrm/civicrm/ rather than under www/components/com_civicrm/ or such?
I suppose I should also say that I haven't knowingly put these resources under admin, so I am assuming they were placed there as standard Civi installation. If I've improperly configured Civi, then my question becomes: What did I do/not do to cause this?