While it will not stop malicious hackers, adding disallow rules to your robots.txt file requests that legitimate search engine crawlers ignore your sensitive media folders.
Or for newer versions of Apache: