I have quite an number of sites that need a security.txt file in the .well-known directory. As far as I can tell there is no option to create the directory and upload the security.txt file with the File Uploader Extension.
I have done something similar. All you need to do is set root in the dropdown and create the directory in the subdirectory field. After that, attach your file and send it to the sites.