the Private files folder outside of “sites/default/files”

Question

The Private Files directory is outside of the sites/default/files directory.

Is that fine? I haven't got any problem with that, yet.

I'm using Drupal 7, if that makes any difference.

Answer 1

TL;DR - It is okay even if you place the private files directory outside the sites/default/files directory. In fact, it is recommended that you keep it outside the Drupal root (source). This is hard to implement on shared hosting.

More explaination:
When you specify the path of the private files in Drupal's configuration, Drupal places a .htaccess file with Deny to All in it. Which means that Apache will not be able to serve any of the files inside that directory. The files inside the directory can only be served by Drupal and their paths are resolved as Drupal path.

Example: Let us compare how placing the same file in public and private directory changes the way Drupal handles it. Say the filename is brochure.pdf:

1. Public file path - If we place brochure.pdf in public directory with path sites/default/files. And in the browser you hit http://yoursite.com/sites/default/files/brochure.pdf.
   This request goes to Apache (considering it as a server), Apache tries to resolve the type of request. It tries to go to the directory structure and see if it can fetch the file. In case of public files it has the permission to do so. It directly fetches the file and returns to the browser where it is presented or downloaded. In fact the request doesn't even need to go to Drupal or the PHP interpreter for that matter.
2. Private file path - If we place brochure.pdf in private directory with path sites/default/files/private. And in the browser you hit http://yoursite.com/sites/default/files/private/brochure.pdf.
   Again, the request goes to Apache and it checks the directory to locate the file. It does not have permission to fetch the file from private directory due to Deny to All. It passes on the request to Drupal. Drupal then does the access checks as it does on all other menus (routes in D8), with access callback.

So, to summarize, it should be okay to place your private directory outside the public files.

Note: If you are hosting your site on other servers and not Apache, you might need to check if you need some extra settings as .htaccess restrictions might not work with them.