Manager can also let attackers check if arbitrary files exist on systems without logging in, doesn’t protect against brute force login attacks, and stores PHP session files in the web root ...

The solution, included in version 6.9, is simple enough: simply delete the file -- which was never part of the plugin's functionality anyway -- and other unused .php-dist files.