Website security question

Question

PHP

We are talking about a classic web server for example on Debian + Apache language php
I have a question about such a method when some files are placed above the www directory, in particular:
1. What is the idea of ​​​​this way of arranging files in general?
2. What is the point in this, because if an attacker finds out the password for ftp, then these files will still be available to him?
3. What kind of files and scripts should be placed above www?

Answer 1

1. There is no direct public access to files
2. If he finds out the FTP password, only those files that are accessible via FTP will become available.
3. Scripts that will not be directly accessed (files included with include and require constructs).