Because the file is served and needs to be accessible via the web server. sites/default/files is typically the default location for uploaded content, or content that is generated dynamically, which these CSS/JS files are.
Your situation happens to be because css (Central Safety Services) happens to be the same directory that Drupal uses to store these files. The recommended solution is to update the path name in the database for their files to something else.
Drupal has the ability to configure the directory where the files are stored, under File System in the admin, but ultimately it has to store them somewhere below Drupal root directory.
Drupal 6: http://drupalsitename/admin/settings/file-system
Drupal 7: http://drupalsitename/admin/config/media/file-system