The /sites/* solution makes sense for many multisite configs, I feel ... Just as long as there's an admin-configurable way to override the default. E.g., for private files configurations I've always preferred going above the webroot, such as "../sampledirectory