In reply to Knut Sparhell.

You can disable it with a constant. The file editor becomes inaccessible (403 Forbidden), not just "hidden".

Or you only allow clients to have the Editor role, or a custom admin role without 'edit_plugins' and 'edit_files" capabilities

All my clients have this constant set, and some a custom role.

If this was removed from core any admin (with 'install_plugins' capability) could install a plugin with such functionality, or even database editing.