I asked tech support about this. Less than helpful is an understatement.
Is there a way to prevent them from accessing and downloading these file folders? Can or should these particular folders be set up as another "web" with its own FTP password or?? (I don't want to blow up the site dinking with FP extensions, obviously) I think there has to be some kind of workaround for this. I can't be the first person challenged with this scenario.
Sometimes I think: God deliver me from FP and the trouble it's caused.
I've downloaded several sites using FP and never got the extensions. But if you want to hide something, put whatever in a folder labeled _whatever, but don't forget to include the underscore first. This will hide it from the user unless they know enough to reset their web setting to view hidden folders.
Idiotgirl is right on that. It makes it easy to publish, but also easy to screw up. Besides, mixing FTP and FP is not a good idea. When you load to a FP site using FTP, FP won't always see the changes. You may end up with something changed that you don't want changed.
And Idiotgirl (couldn't have picked a better moniker) there's no method is fool-proof. The only hidden file that FP displays by default is _private. If the user doesn't know how to reveal the other hidden folders, it's a method of protecting something through ignorance.
Look at it as job security. If they screw up, who they gonna call - not ghost busters :)