That's security by obscurity. In a sane setup with proper permissions, a hacker woudn't even be in your filesystem. If he were and your system was compromised, he could just take a look at your web server config files.
Good fundamentals are always good - there's a reason web servers are run as specific users (www-data), you should always disable root ssh access (and try to work as a regular user w minimal use of sudo), give files the minimal permission settings needed and so on.
Sticking files outside the standard /var/www seems cargo culty to me. There's many reasons to do things other ways (some distros use /srv/www I think), and sometimes having a seperate folder per webapp is a good idea for maintainability. I sometimes have applications that run their own servers, for example and those don't belong on /var/www - say something that runs django would run in its own directory, but this is mostly for maintainability and cause my main web server dosen't need to see those files
I'd ask the developer to explain why this is so anyway, just for a laugh.
1A bit obvious perhaps, but any directory you use on your server should be properly secured, regardless of how it is named. – Anaksunaman – 2016-03-31T20:47:23.940