They can trivially swap out that file for their choice of stuff you don't want on your website. They can do it for every 1/1000 requests so you don't know wtf

They can trivially swap out that file for their choice of stuff you don't want on your website. They can do it for every 1/1000 requests so you don't know wtf is going on. They can use the host header to only do this to your website. They can simply delete it and your content is gone.