Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the security of the website? I have seen this claim, but I can't see a reason why this (functionality beyond load balancing) would be the case.
Just putting a simple load balancing reverse proxy in front of a broken web application does not fix it. It will implicitly some kind of sanitize HTTP requests at the protocol level, but it will not protect against any security issues at the web application level, like SQL injection, local file inclusion etc. It will also not protect against uploading malicious files.
Note though that are reverse proxies which can actually help. A Web Application Firewall (WAF) is usually a reverse proxy too. Common reverse proxies like nginx or Apache can be extended with functionality to filter traffic and even add WAF functionality. But this is functionality which needs to be explicitly added or configured.