Typing complete path to .html help files in module bypasses user permissions

This really isn't a security problem. You're storing documentation as flat html files on a web server. There's not really a lot you can do about the fact that the web server will serve HTML, unless you explicitly tell it not to (as you have done with your .htaccess fix). That said, it might be a good idea to document this in the README or something so that people will be aware of it.

Also, if you come across an issue you think might be a security problem, you should report it to the security team instead of in a public issue. See https://drupal.org/security-team for details.

Well, these are plain HTML-files. They can be accessed, as any HTML-file on a Drupal site can be accessed, by anyone who knows or is able to guess the URL. This access is not something that happens through Advanced help (or even Drupal), they can be accessed because the default web-server configuration of a typical Drupal site permits this type of access. For that reason, I do not consider this a security vulnerability.

However, as you both point out, you can stop people from accessing these files directly, forcing access through Drupal. Having this:

<Files *\.html>
Order Allow,Deny
Deny from all
</Files>

in a .htaccess in the project's help directory should disallow this type access.

It as the responsibility of the project author to make sure this type of protection is in place if the project's author has files in the project directory that merits protection from direct access.

Adding a related issue.

A default .htaccess has been added to the latest snaphot of 8.x-1.x-dev.

Should be backported to Drupal 7.