The document root is the root directory of your website.
For example if your domain is mysite.com then when I browse to http://www.mysite.com I will see a web page. The folder that contains this page is your document root. Any directory out side of this directory is outside of your document root.
The reason it is a security issue if you store images in the file system under the document root is that if php can store images to a directory then it can also store other things. If the directory is under the document root then a use could exploit your script and store a php file in a this directory, then use their browser to browse to that page and execute their php code.