Are you sure it is not wrong URL/path issue? Double check it.
Chances are that server settings that are "most likely responsible for restricting public access to php files in the themes folder" are placed in .htaccess file, either in www-root directory or other location (for example, .htaccess file may be in the wp-content directory). There are also chances that the directive is specified in apache's vhost file for specific vhost.
The directive may look like:
deny from all
which would produce 403 Forbidden, not "404 Not found".
So, again, double check URL of that file. 404 Not found is rarely any other thing than exactly what it says - no resource existing for URL.
Apart from all this, you should note that hitting specific .php file in themes directory for any reason is considered to be bad practice - all that you need is already present in Wordpress API. Smart guys that made it has thought of ajax and made the means of using it right the right way available.