RewriteRule ^wp-content/(?!themes/.*/core/css/custom\.css\.php$)(.*)\.php$ [R=404,L]
Aside: As written, this rule/directive is not correct. It is "missing" a second argument. (The third/flags argument will be treated as the second argument and result in requests that match this pattern being erroneously rewritten to the literal "URL" [R=404,L] - which is obviously not a valid URL and will likely result in a 404 in a very roundabout way... by WordPress, not Apache.)
I would expect the above rule to have a single hyphen (ie. -) as the second argument. For example:
RewriteRule ^wp-content/(?!themes/.*/core/css/custom\.css\.php$)(.*)\.php$ - [R=404]
The L flag is not required here.
(That might seem subtle to the casual reader, but it is a glaring error/typo.)
HOWEVER, you do not need to modify that rule to resolve your issue. (Without knowing more about this, I would avoid editing this rule in case it was a WP plugin, rather than a "person", that wrote it. Although the fact that it is currently "wrong" as written still remains.) Instead, you can just add an additional rule at the very top of the .htaccess file to make an exception for the file in question. For example:
# Prevent further processing when file is requested
RewriteRule ^wp-content/plugins/plugin-name/public/js/service-worker-loader\.js\.php$ - [END]
This assumes Apache 2.4. (If you are on Apache 2.2 then use the L flag instead of END.)
This rule prevents any other mod_rewrite directives in the remainder of the .htaccess file being processed when that file is requested.
UPDATE:
Would it be possible to place a rule in another htaccess placed in the same directory of the file we're trying to grant access to? Or the higher htaccess takes precedence?
Yes, you can do that. Create another .htaccess in the subdirectory and simply disable the rewrite engine. For example:
# /subdirectory/.htaccess
RewriteEngine Off
Since mod_rewrite directives are not inherited by default, this effectively overrides the mod_rewrite directives in the parent (directory) config. The mod_rewrite directives in the parent are not processed so the request is not blocked.
(Each Apache module is processed differently. Directives from other modules, such as mod_expires, would still be processed in the parent/root config.)
