Why the private key is stored in the public accessible directory, but /var/lib/tor?
The key is not in a public accessible directory by default. Assume the hidden service is in the directory
hidden_service. This has the following permissions:
> stat /var/lib/tor/hidden_service File: `/var/lib/tor/hidden_service' … Access: (2700/drwx--S---) Uid: ( 117/debian-tor) Gid: ( 128/debian-tor)
So the directory is only accessible by the user
When talking about a hidden website you need to configure a webserver. Usually the webserver should not access the hidden service directory. Instead it should have an own root directory with all needed files.
So in neither case the private key is publicly accessible.
As Jens Kubieziel notes in his answer,
/var/lib/tor/hidden_service "is only accessible by the user
For greater security, one can use full-disk encryption using dm-crypt with LUKS, and enable unattended reboot using a Mandos server. One can also keep
/var/lib/tor in a TrueCrypt volume, and decrypt after boot. It might also be possible to secure
/var/lib/tor from rights escalation attacks through advanced Linux foo.