Via the Site Identity settings in the Customizer, I can’t upload a favicon image. I get the error message ‘Sorry, you are not allowed to upload this file type.’

But if I just copy the favicon to my root directory via my Cpanel File Manager it works fine. Why is WordPress disallowing this? Is there a security reason?