Purpose of the .htaccess files in the Drupal files directory?
The first .htaccess file in the root directory is for routing and to override any PHP related settings. 

The second .htaccess file under sites/default/files is for security purpose, to avoid any file injection. This folder is Drupal's main upload folder. 

The upload folder can be moved in different places, or in a multi site setup you could have more than one folder. That is why they provided a separate .htaccess instead of putting everything in one place.