I've always put an empty index.htm page in folders that don't get human traffic or don't have a script handling them. Is that still best practice? or do we just rely on .htaccess? or something else?
Ya, it's still a good idea. Better than .htaccess because .htaccess only works on Apache (and if you are still using Apache, you should probably look into Nginx), so you have better coverage across different servers. If it's something you can entirely block for public consumption (not just the directory listing) and you use Cloudflare, just make a firewall rule to block it for everyone upstream of your server. If it's something that you just want limited access for some people (for example an admin control panel), check out Cloudflare Access.