On some Web Hosts .htaccess file permissions MUST be 644 and cannot be locked (CHMOD) with 404 permissions. When BPS automatically updates your root .htaccess file it will also be automatically locked (CHMOD) with 404 permissions.
If this issue/problem is occurring for you each time you upgrade BPS then please post your DNS Name Server name. We will add/exclude your Name Server in the next version release of BPS so that BPS will no longer automatically lock your root .htaccess file if you have provided your Name Server name. Please ONLY post Web Host DNS Name Servers and NOT Private Name Servers. Thanks.
You will find your DNS Name Server on the BPS System Info page.
DNS Name Server: xxx.YourNameServer.com
403 Errors can also be caused by the Broken cPanel HotLink Protection Tool see this thread for details >>> http://wordpress.org/support/topic/plugin-bulletproof-security-broken-cpanel-hotlink-tool-404-errors-unable-to-edit-htaccess-files?replies=7