Critical issue caused by Wordfence?

I have Wordfence loaded on at least a dozen of my websites. It works fine, until today, when I got this “critical” error message, on only one website:

Critical Problems:

* Publicly accessible config, backup, or log file found: .user.ini

I called my hosting company and they looked in the file, to find that it only contained a Wordfence doc.

So, what’s the deal? How can this be a “critical” problem, if the .ini file was created by your software?