Should all files be located publicly?
The doc root should be where index.php is; that's where all requests for non-existent files are rewritten to.

If you mean "should the application and the front end be separate, like in other frameworks?", then yeah, maybe they should. But they're not at the moment, if memory serves there was a declined issue about doing just that when D8 was first being planned.