Adding the possibility for default htpasswd file (/etc/nginx/htpasswd/default) that is used when no file named after $VIRTUAL_HOST is present.

This can be used when all virtual host should have the same Basic Authentication anyway.

Or as an extra security measure to make sure that no service is exposed to the wild internet without authentication even if there is a error in the configuration and/or file naming.

If there are several services under different subdomains it isn't easy to get this right in the moment. Of course you could work with symbolic links, but this also gets messy very fast. And especially while you try out things and polish your configs and services it happens easily that a service is exposed to the wild without you noticing at first (hopefully only at first).