The web server must be able to write here, and files in it are served to visitors. This combination makes it a common place for attackers to leave files after exploiting an upload or file-handling flaw.
Normal uploads are images, documents and media. Executable PHP files in this folder are a strong warning sign, because legitimate WordPress sites rarely need them there.
Configure the web server so scripts cannot run from the uploads directory, monitor it for unexpected file types, and include it in backups. During an incident, compare its contents with what the site actually uses before deleting anything.