I have been browsing the code for the upload plugin and its default storage provider. The upload plugin actually stores all the information about ‘files’ in the Strapi database. Each entry includes a ‘url’ field, the value for which is created by the storage provider. The local storage provider creates a URL of the form /uploads/{hash}_{name}.{ext} and the upload plugin has a middleware handler [see code] that intercepts requests for these URLs and serves static files, but it only matches file paths - not the folder they are in.
If you did want to list all the files, the upload plugin does provide an API route (/upload/files), but what you get is the database items, just like any other collection. You also need to provide an auth token. From an item, you can then use the ‘url’ field to fetch the associated file.