You can access them only from a servlet or JSP outside the WEB-INF directory,
Not necessarily.
Consider the same example which I had explained in my previous post. Now lets add one more jsp page lets call it SecuredJspTwo.jsp inside WEB-INF.
After accessing MyJsp.jsp control is dispatched to SecuredJsp.jsp. Now include the following code inside SecuredJsp.jsp
Since request.getRequestDispatcher() can take a relative path now request will be dispatched to SecuredJspTwo.jsp which is also inside WEB-INF.
Consider my next scenario
Create a servlet inside WEB-INF/classes/com/example/TestServlet.class
add the following in the service method
Access this servlet directly from your browser and you will end up in SecuredJspTwo.jsp page.