Also: the way I discovered this was that one of the directories was the shared directory for my website blog (both source and target static-site generated files

Also: the way I discovered this was that one of the directories was the shared directory for my website blog (both source and target static-site generated files), and from my Linux machine I had r-synced that to my remote web server, and noticed bots had found these .DS_Store files in most directories of my website, which included (due to the .DS_Store files) unlinked files which the crawlers wouldn't have found if not for the .DS_Store files. So I was then getting 200 HTTP requests on the .DS_Store files and I noticed that in my server logs, and then it occurred to me how they had got there (via Syncthing, and me not noticing them locally on the Linux machines until I looked for them and found them).