True, however it is more secure outside of the web directory. The suggestion came from Infopop a very long time ago during the 6.x series in one of their news letters.