Sorry I’m not quite sure about all the back and forth, the code Sparkle generates is correct, we have tens of thousands of customers and quite a few using password protection, this is an isolated issue with the web host, and as mentioned we will diagnose once we are able to test it.
Yes Microsoft IIS servers are misconfigured for webp images (but also svg, woff and woff2), they need to be properly configured as per this thread:
Yes it is correct for images in password protected pages to have a .php file extension, that’s because the images too are password protected and will only be loaded if the user is properly authenticated. I’d encourage people who are not familiar with code to trust Sparkle is doing the right thing.