Interesting ... the 2004 link (and probably the others provided) shows some debate.
The reference to the 2004 discussion ... points out that info should be included in installation docs.
however, makes no mention of directory listing.
Doesn't check for list 'directory listing' ... at least in 'English' ... except one ... vendor.
BTW, an addon/plugin could have a vendor directory not detected by the security check.
Distributor of platform that has apache/httpd in their repo has decided how apache/httpd is configured ... right out of the shrink wrap, so to speak.
Default for apache on CentOS and RedHat is to list raw directories, me thinks.
Depending upon where one host and how, providers also have their own ideas.
One might see that the kernel is based upon el7 but that may not mean 'default' httpd/apache config.
As long as am on the topic of what's needed ... I wonder why there is included in default distribution tools like Jmeter testing. Have had to help a user 'clean up' after they explored what that was ... wanted to 'test' their production environment ... even though there were comments/warnings, etc. all over the place.
Why not have a 'core developers' plugin that installs all the extra ... developer stuff? Am not really asking that question ... just thinking out loud.
'spirit of sharing', Ken