Basic Authentication needs to respond with 401 for unauthenticated requests as defined by RFC2617.
However, that could cause an information security leak.
For example, the GitHub API uses a version of Basic Authentication that is slightly different from the standard defined in RFC2617. According to the standard, unauthenticated requests should receive a 401 Unauthorized response, but this could disclose the existence of user data. To avoid this, the GitHub API returns a 404 Not Found response instead.
GitHub Basic Authentication Documentation