Should all files be located publicly? Should all Drupal 8 files be located publicly, or should something like sites be the public document root?

[Michael@devserver drupal-8.1.1]$ ls -l
total 228
-rw-rw-r--.  1 Michael Michael    262 May  4 04:20 autoload.php
-rw-rw-r--.  1 Michael Michael   1437 May  4 04:20 composer.json
-rw-rw-r--.  1 Michael Michael 146226 May  4 04:20 composer.lock
drwxrwxr-x. 12 Michael Michael   4096 May  4 04:20 core
-rw-rw-r--.  1 Michael Michael   1272 May  4 04:20 example.gitignore
-rw-rw-r--.  1 Michael Michael    549 May  4 04:20 index.php
-rw-rw-r--.  1 Michael Michael  18092 Sep 23  2014 LICENSE.txt
drwxrwxr-x.  2 Michael Michael   4096 May  4 04:20 modules
drwxrwxr-x.  2 Michael Michael   4096 May  4 04:20 profiles
-rw-rw-r--.  1 Michael Michael   5889 May  4 04:20 README.txt
-rw-rw-r--.  1 Michael Michael   1596 May  4 04:20 robots.txt
drwxrwxr-x.  3 Michael Michael   4096 May  4 04:20 sites
drwxrwxr-x.  2 Michael Michael   4096 May  4 04:20 themes
-rw-rw-r--.  1 Michael Michael    554 May  4 04:20 update.php
drwxrwxr-x. 26 Michael Michael   4096 May  4 04:43 vendor
-rw-rw-r--.  1 Michael Michael   4006 May  4 04:20 web.config
The doc root should be where index.php is; that's where all requests for non-existent files are rewritten to.

If you mean "should the application and the front end be separate, like in other frameworks?", then yeah, maybe they should. But they're not at the moment, if memory serves there was a declined issue about doing just that when D8 was first being planned.