Ok, theoretically each domain is compartmentalized, so they all have their own .htaccess files, but there has to be something that interferes. That’s the only explanation I can find.
In any case, I installed BPS in both domains WP Multisite installations and didn’t add or touch anything. So the .htaccess files are “standard”, with the security modes normally activated.