Skilling cannot be activated unless certain security conditions are met. The most important of these is the creation of a private file system, usually a directory not accessible to the web server. All student submissions are stored in the private file system.
A private file system is optional with Drupal, but is required for Skilling.
Wait, I don't get it. If the web server can't access student submissions, what's the point?
The web server can't access the files, but Skilling's code can. Skilling runs its own security checks on data requests. If the checks pass, Skilling reads the files itself, and passes the data on.
Is that an extra load on the server?
You're right, it is an extra load. It's not significant for a small class. However, if there are thousands of students using a Skilling site, it's something to consider in capacity planning.