And that's coming from the developers point of view? What about legal terms that don't allow developers to 'backup' an image of your data on their local machine/remove all data from their machine after the contract is completed?
If you are concerned about it why not get a second server/vps and just put up what they must work with. Consider it a developer server and just migrate when they are done.
None. You don't give them access to a box with money sites on it.
What you could do is use something like a liquidweb smart server and snapshot the main config on a smaller instance for dev purposes. Then when they're done, just cancel it.