Where To Upload Files

I have frequently read that you should upload all files to and create folders in the public html. But recently an IT manager told me this sacrifices security completely. So in respect of setting up a new site,

Folder name (at server)
public html Q1 You place the index.htm file here, correct?
public ftp Q2 What do you place in this?
w3 Q3 do you place other folders at w3.sitename here?
user created Q4 are folders for the subdomain folders created here (and not in the public html folder) - for security reasons?
Q5 For add-on domains e.g. w3.sitename/add-on/abc.htm where is

it best to place the folder for the contents e.g. abc.htm?