Yes, it's doing a call back to your own store, via CURL, to attempt to access a file that the .htaccess rules should have blocked. It's looking for a response that indicates that the file access has been blocked. It is expecting to NOT receive an HTTP 200 OK response.
If your host's firewall is blocking things, then it would trigger something other than a 200 response, which then Zen Cart would treat as correct.
So, your host's loopback explanation still doesn't make sense, unless their loopback system is incorrectly responding with an HTTP 200 response instead of an actual ERROR response. Perhaps your host should look at how they serve up their error messages.