it must show an error.
To return a 403 Forbidden when accessing /site/index.php you could do the following before the existing rewrite:
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteRule ^site/index\.php$ - [F]
The condition that checks against the REDIRECT_STATUS is necessary in order to prevent the rewritten URL also triggering a 403.
However, it would be more SEO-friendly to redirect/correct such requests instead.
Aside:
this line does hide the extension successfully.
Just wording I guess, but "this line" doesn't "hide" anything. It specifically adds the extension back. (The extension is already hidden in the initial request.)