index.php in the root folder?

The problem is that everything in DOCUMENT_ROOT becomes available from the browser. And any mistake can be very costly. 
That is why index.html was placed in all directories in CI3 and less. That is why in CI4 all code was moved from the public directory.

I don't see any problems with shared hosting. Shared hostings always give access to a directory higher than the public directory.

Yes, often the public directory is called public_html. This is not to be feared. You put all the code in the parent directory public_html, and the entry point from public to public_html.