It is not safe. The user can run their own programs, compilers, exploits, etc… It basically opens the door for mistakes and abuse.

I would have these people fax/email you a copy of their drivers license or other photo ID, their ISP email address, and their home phone number, along with a reason for requiring shell access. If they meet the requirements and you have no reason to distrust them, I would grant shell.

Either that, or I would ask the customer to upgrade to a VPS, where any exploits/abuse wouldn’t bother the rest of the users on the server. I think I would sleep better with the second.