Traditionally all Drupal core, vendor and module PHP files are in the webserver accessible document root folder. This is a security weakness because Remote Code Execution vulnerabilities are found all the time when random PHP files are directly accessible. For example Drupal 8.2.7 had to fix a vulnerability in the vendor directory where a library shipped a PHP file exploitable by directly accessing it. It is possible to run a Drupal 8 site with a clean docroot folder that does not contain code files and is therefore a lot more secure by default. Core patch for image styles