That's not an accurate, or at least not a complete, statement. Apache ignores file-based access control in this case, because Apache isn't handling the files, y

That's not an accurate, or at least not a complete, statement. Apache ignores file-based access control in this case, because Apache isn't handling the files, your FastCGI server is. Access controls in a Location section work as expected. Perhaps it should be added to the FastCGI documentation in a very emphatic and clear way? Maybe it should also default to no access without an explicit declaration of what the user wants (though that would break people's configurations, so would need to happen in a major revision).