> It doesn't sound like they were using MultiViews at all but some rewrite rule that rerouted all requests ending in .srv to a shell script in /bin

The request to a.srv (in their example) was only authorized because a request to /index.html/a.srv looked like a request to /index.html to the auth module because the auth module did not check PATH_INFO. The request was then passed to the ssid daemon (not shell script) over a UNIX socket.

a.srv ended up in PATH_INFO because index.html existed.

The developer(s) of the auth module only checked SCRIPT_NAME and index.html was valid for unauthed users.