I would guess that if they're not in public_html then Apache doesn't know where to find them.
The fact is, if someone can view your image, they can download it. There is no way for you to put an image on the web and prevent someone from saving a copy of their own. Even if you make it impossible for them to directly or indirectly download the file from your webserver, whether it's wrapped in SWF or something else, they can just screenshot your page.
If you're trying to protect an image, use a watermark, a low-resolution version, or don't put it on the web at all.