In legacy ASP.NET, your entire project was public. In ASP.NET Core, ONLY the wwwroot folder is accessible from the web. This is the **First Firewall** that protects your project configuration (C# code, appsettings.json) from hackers.
For your CSS and JS to load, you must enable this middleware in Program.cs. Standard for all applications.
Senior architects use StaticFileOptions to set long-term **Cache-Control** headers (e.g. 1 year). This tells browsers to keep your images/JS in memory, reducing server load by **80%** or more for your 1M+ user application.