Index files are a good protection for visitors that haven't seen the site yet, but if google came through and crawled the directory before you put your index.php up, it"s possible that the direct links to files in a specified directory are still accessable via web through links on the google (or whatever) SERPs.