Directory Browsing Question

Long story short – If you don’t trust the users with the role you’ve given access not to have full access to the servers filesystem, you shouldn’t use this plugin.

This plugin is not designed to be used as part of a regular-use flow, it’s not designed to prevent users accessing files stored elsewhere on the server.

The plugin respects any and all restrictions placed upon the PHP user, which would normally prevent you reading another accounts files, but in your case it sounds like that’s not the case.
To do that you’d want to use PHP-Fpm with separate user accounts per WordPress site; but you’d then also have to do user permissions to prevent reading from files you don’t want them to access.

The “Lock browsing to directory X” was mostly done for fixing a UX issue, where you could get lost in the filesystem, NOT as a security feature (It’s not a security feature, do not use it as such).

Anyway – Future versions of the plugin will probably lock users to ABSPATH or WP_CONTENT_DIR with the option to lock it to another directory. Having the free-text option has lead to people using it incorrectly.

tl;dr: Don’t use this plugin. Only use this plugin where all users who have access to it are trusted to access the entire server. If you have a use-case for this plugin, you’re probably doing it wrong and should re-evaluate why you’re using it.