I don't think giving them ftp is that dangerous a thing as long as you setup their own ftp account. What are they going to do? Delete your site?! What motivation have they got for that? Are they going to hide loads of OBL everywhere? STEAL your site/database, maybe? But if any wrong doing took place wouldn't they be the number one suspect? It would be like committing a robbery and leaving your passport behind!
It WOULD be the best way to give a thorough quote. Many times a salesman at my company sells a client
seo only for me to find its a content managed system which needs a lot more work than the quote was for.
Why cant you upload the site to a temporary location and give them access to that?