I have seen other websites where their config.php files (where it contains their mysql database username/password) are protected via .htaccess files.

Does this also need to be done for cubecart?

it helps but you dont have to do it.