All files are organized in different path based on the access.
File Access:
Browser can not access all files directly due to security issue. According to common standard policy, publicly access-able files should be place in "webroot" folder and other secure files should be place outside of it.
For example, If we upload a logo then it must be done in webroot but if we upload a paid e-book then it must be done outside of it because if we upload in "webroot" folder then it has a chance of direct download.
See also Class and Objects