It should update their password. It does a lookup based off username. Could be an issue trying to match their username. Does it do this for every user or just some users?
As for new users not being added to the password file it can only do that when plaintext password is available. This means the synchronization only takes place during login, during registration, or during profile edit when password is changed. If they're logged in then subscribe it won't synchronize them until the logout and back in.
I don't really recommend using old htaccess folder access anymore though. CB Gallery and CB Package Builder can both provide easy to use file management directly in Joomla that can be controlled by CBSubs using ACL or URL Part protection.