[throwaway7767]

Yes, either that or a dedicated sudo-enabled account. It's a slight step up from the older setups where they had a dedicated account with a common password known to all the second-level and higher techs.

It's because 90% of users don't know what they're doing and at some point will ask for support, and they probably won't be able to get the techs access when needed. It sucks for the 10% who are capable and willing to operate their servers independently.

Source: I've worked at hosting companies.