Ten years ago, default server settings (Apache, Nginx) allowed directory browsing. Today, Options -Indexes is standard. Most shared hosting disables this by default.

It is trivial for a hacker to name a file Episode.01.1080p.mkv.exe or embed a malicious JavaScript in a fake index.html . Ransomware attackers love "Index Of" pages because they attract users with lowered guard.