Using FTP to a FPSE enabled server would risk corrupting the extensions,
yes.
From what I understand, the idea of the _private folder is just that: it's
private for your eyes (that is, the site owner's) only and not intended for
public viewing, or even "registered user only" viewing (if that is your
intention).
I don't know if it can be easily changed (would mean your server admin would
have to change the permissions on the folder or similar).
If you want a user access facility with ease of use and its basic function
is just to protect folders wthin the website, might I suggest
www.directorypass.com? I use it and it's simple and effective.
It offers a free cgi/perl script to set up the protected directories. It's
one file, runs on a linux server and easy to set up, and you have control
over the user setups for any particular directory you like.