Why are these pages dangerous?

If you can download any file from the server, you can see the PHP programming that is a part of many of the pages. You can see how any action is done, including seeing what passwords are needed to various actions. You can also see the encryption key used to encrypt personal information that is on the server.

If you can upload any file to the server, you can change any of the pages or add new ones. You can turn the whole website into something completely different; you can destroy, corrupt or encrypt any of the existing files.

So, why are these actions provided at all? Without them, you would have to have some sort of FTP app to get raw information from the server or put new or updated pages on the server.