I've just completed a brand new install of PyroCMS on the dev server also it seems the system and addons folder reside over the document root folder within "public_html".
PyroCMS relies from CodeIgniter and each time Used to do a CodeIgniter do the installation always had me put the system folder below the document root for security reasons. Should not this be true using the PyroCMS install?
Just don't tell Apache for everyone PHP files as text/plain and you will be absolutely fine. -)