Why is a sensitive backup archive unsafe inside a static server's document root?
Its presence always stops the web server from serving normal pages.
The server automatically deletes any archive it finds.
Every archive in a document root executes automatically as root.
Files under the served tree can be mapped to public URLs and downloaded.