For security reasons, Apache prevents PHP files from being downloaded so that the source code is unreadable, unless there is a server failure while you attempt the download. Normally, you'll only get the HTML output of a PHP file on your local computer as a "gift", not the source code. The config.ini.php contains only PHP code, and no HTML code.
If you locked your config.php file down at the server level with a 444, then it wont be able to be changed through the Control Panel. A CHMOD setting of 644 for that file is advised. The includes directory (IIRC) should be 755. That CHMOD setting will pass within the "Permissions Checks" control panel tool.
though via .htaccess, setting a user/password for your /admin and /templates/default directories is suggested.
