Can we create a core PHP file inside the files folder? As per Drupal's folder structure, custom code is always in sites/modules or in the theme folder. One of my colleagues created a custom PHP file in the files folder. Is this OK or are there any security issues?
Files under that folder are writable by the web server. You could argue that makes it a security risk, but your server would already have to have been compromised in one way or another for it to become so. If your server is configured properly it will only execute PHP files, not serve them for plain-text download.

From the point of view of convention, though, you shouldn't do this. Putting code files all over the file structure makes maintainability infinitely harder.