Joe,
You've described specifically an issue related to *browsing* to files that are not in the webroot. Web page requests are initially handled by the web server (IIS, Apache, etc.), and if found (or if a URL rewrite rule redirects), are passed to ColdFusion for processing. Generally speaking, ColdFusion server does not throw 404 errors (unless you specifically have code that sets page headers and such); web servers throw 404 errors. So the fact that you're getting 404 errors tells me that your *web server* doesn't know where the files are, because there are no virtual directories configured to tell it where they are.
Have you checked your CF7/8 sites to see if there are virtual directories configured for these sites? ColdFusion mappings only allow ColdFusion to access files outside the webroot when doing ColdFusion stuff (like CFINCLUDE or CreateObject). Without virtual directories, I would absolutely expect to see 404 errors when trying to browse a file that is outside the webroot.
-Carl V.