sounds like how wordpress used to be. could explore all the folders and get any file of site with something like website.com/content/2010/

That would be an incorrectly configured http server. Not wordpress.

Things used to be distributed with .htaccess files, but only apache uses them and so that got offloaded on "blame the admin for not following documentation." Forgetting that nobody ever adds such to the docs.