Have reviewed your install and am not finding an issue. I created a new user, subscribed them, logged in, then navigated to the protected directory, was prompted to login, logged in, and had access just fine. I've re-tested this 3 times and it's still working. I deleted the htpasswd file so it can resync now though. Please retry and see if it'll work for you now.

Yes, it opens fine in my browser as a PDF.

As I've explained earlier though there are far far better ways of doing this. Truly you're taking the complicated path. htaccess protection is bested used for protecting directories outside of Joomla. Inside of Joomla you're better off just using an extension that is designed for this. For example DOCman can do inline PDFs like this securely just fine and can be protected by CBSubs easily.

Just a bit curious, were you also able to change the system generated password to a private and still get the same results.

I created the user from backend and not frontend (supplying my own simple password), but what generated the password should be irrelevant. A successful login will synchronize whatever password the user supplied to the htpasswd file. However, there is limitations to htaccess protection passwords. They are limited to 255 characters and can not contain a :. It's possible the generated passwords are invalid for htaccess protection and you probably need to allow user supplied then add validation to it to limit what characters can be supplied. You maybe able to try a different password encryption method within CBSubs > Settings > Integrations > Folder Access to avoid : conflict issues (MD5 might work).