What is the use of sync directory?
It's where Drupal exports configuration (YAML files) to, and reads configuration from (for example using drush config-export and drush config-import respectively). The term "synchronising" refers to Drupal comparing the contents of those files to the site's active configuration, and applying any config that's changed.

You want to keep that folder out of the public web server for at least 2 reasons:


Those files could potentially contain sensitive data
You're potentially exposing the structure and configuration of your site to the world. Those details could be advantageous to an attacker.


Best to err on the side of caution and keep them away from prying eyes.