The answer to this is more complicated than yes and no.
YES, using an ordinary html setup, you can not access files outside WebRoot.
HOWEVER, it is possible to access files outside of webroot, as suggested earlier, say, by using openbasedir, or even better, through recommended practice (php attachment storage, etc). An example:
vBulletin allows the user to store attachments in the filesystem, even outside of the public_html directory. These files are still downloadable, or viewable, you just have to use vBulletin (or the script designed to store/download them) to do so.
For most users, yes, storing something outside of webroot is the best answer.
WHMCS Guru - WHMCS addons, management, support and more. WHMCS Notifications Extended - Add slack, hipchat, SMS, pushover to WHMCS !!
Linux Problems? WHMCS Issues? +1-866-546-8914 (linux-14) or @whmcsguru on twitter!