It's bad circle - while i have file access to attachments a hav'nt any reasons to make correspond feachure requests to modules, but you can't leave me without file access while do'nt provide repleacement feachures in modules %)
May be leave it as is?
in any time you can 1) add admin (site-wide) or teacher (cource-wide - it's better) setting - to hide or not hide moddata folder in cource files with request to think twisely before turning on visibility and making direct updates in module data and make feachure requrest to disallow this turning in future and 2) make protected module data visible only for module - and leave non-module protected data visible any-way