Yes, the uploads folder initially has to go to 777. Then you upload one image, and change the permissions back to the default (usually 755). WordPress will still have access to the uploads folder - it only needs permission once and then it always ahas it.
True, important stuff can be housed outside of public_html. But some hosts won't allow you to do that. And then you have to do more finagling to get things to work. But the way WordPress is set up, it's still safe to do it how it is now, as long as your permissions are sett appropriately.
Setting 777 give *anyone* access to your site. All they have to do is find the password to get in (some of them don't even need that). Once they're in, if everything is set at 777, they can do major damage, get info on the server and then compromise the entire server - take down many sites in one swoop rather than doing it one at a time.
How they get in? I don't know - I'm not a hacker. I *do* know that, to protect yourself, 777 is NOT a good thing to keep your filesystem at. If this host is telling *this* guy to do that, imagine what all the other people in his server are doing? Everyone could be open. That server is way too insecure for anything - he needs a new host who knows what they're doing.