Setting up credentials for support needs, in my opinion, is a last-resort option. Sometimes access is generally required if you really need to dig deep into an issue, especially when you've exhausted all other avenues to troubleshoot. However, there is always a risk, and before I request access, I make sure I have an agreed disclosure with the client. Plus, I tell them to ensure they make a full site backup (including the DB).

One of the things I really liked when I was developing Joomla templates and running my own site(s) on Joomla, is that it has an awesome ACL (Access Control List) setup. Extremely powerful! This is something WordPress should really have in the core, rather than having to install a "third party" plugin(s).

For the end-user, it's more about trusting the developer and going on your gut feelings--and common sense. Know who you are giving access to. For the developer, it's about realizing the liability you will accept, even with an official agreement.