Is it safe to have PHP files in the public directory of a craft cms website? I just ‘discovered’ that the developer on my client’s craft website has been migrating his old landing pages to the new setup by cramming the older static pages into the public directory instead of using the CMS. 

There are a lot of PHP files there but they are mostly using a PHP mailer setup - not any database queries.

My question is: how dangerous or safe is it to have PHP files in the public directory?
As long as the PHP files themselves don't introduce any security holes, having them in your web root is perfectly fine. That's not uncommon at all. How they were written makes all the difference, of course. If you aren't sure whether the developer followed best practices for the security of the mailer scripts, that might be of some concern.