Plugin support over Hangouts is really inconvenient for plugin authors and most would no let you do that, particularly if you aren't paying explicitly for support. There's tons of huge drawbacks doing that. Further, if you're going to give me a subsite to work with, that's fine but it **has** to be having the same bug itself. Giving me access to a subsite that doesn't exactly replicate this issue you are using on the main site is usually totally useless in terms of getting the issue solved.

While I agree you should be reviewing authors, that should have been done before installing the plugin on your site to begin with. You wouldn't want to install a plugin on your site that's by an author with known issues. Once its on your site, you shouldn't have any issues trusting the people behind it. If someone really wanted to hack your site, and they were the author of a plugin, they could just issue and update that simply adds users in the code, particularly if it is not hosted on WordPress.org.

Its important before giving someone access to your site to make full database and files backups. Number one, that solves the "developer turned malicious issue" since you can just restore from backup. Number two, you should be doing backups anyways. Number 3, things happen sometimes on remote sites. I know a hugely popular site that once was taken down by the output of a single var_dump being added to it on a VPS server.

If you feel uncomfortable with someone in the backend, a good idea would be to ask the developer why he would like the access. 9 out of less than 10 times, there's a very good reason, and most developers will be happy to answer you. You can also ask what they are planning on doing, or a list of things they will try.

In short, if you don't trust the author of the plugin being in your backend, and you don't want to setup a staging site, you probably shouldn't be using that plugin to begin with.