This is a misconception, I will explain…
The only PHP file that a WordPress site needs to load directly is the “index.php” located in the root of the project and the “wp-admin/index.php” for the administration area, every other PHP file must be hardened for security reasons.
You should not allow direct access to any dynamic file in any sub-directoy, the problem here is that most WordPress developers do not understand this and end up writing the code for their themes and plugins without taking in consideration the security holes that are opening. In this case the captcha plugin that you are using needs to have direct access to a PHP file inside the content directory because its developer did not find a better way to render the images that are generated dynamically by the script.
(Disclaimer: This following paragraph will sound aggressive).
As a security engineer I do not care about any program that do not take security seriously. Many people complain when an antivirus, malware scanner, firewall, or other security focused software let their sites or computers get hacked, and this is not true, most of the time they get hacked because they disabled a featured that they thought was useless (like in this case).
You may revert the hardening at your own discretion, and your site will probably not suffer an attack if you keep this feature disabled, but take in consideration that I wrote the code for that option for a reason. I can not force the whole community of WordPress developers to change the way they write code, I can not force them to not write code that requires unauthorized access to unauthorized parts of the site, the only thing that I can do is to offer a way to prevent this scenario.
I am writing a new tool in the hardening page that will allow you to keep the hardening active for every PHP file with the exception of some files that you can manually select. This will (in this case) allow you to keep the functionality of the captcha plugin while protecting the content directory (among others) at the same time. I plan to finish this new tool for the next version of the Sucuri plugin.
