You can (and should) create a new WordPress user account for them and delete it after they’re done. But, as this is to check a plugin issue, the new user has to be an administrator user, not a limited user, as only administrators can manage plugins.
Your question is about trust.
Understand that you’re already running their code — their plugin — on your site. If they are malicious actors, their code can do equally bad stuff to your site. So if you’re trusting them to run their code (ie plugin) on your site, then the genie is out already… and I wouldn’t worry any more about granting them admin access to the site.
Things you can do:
1) Create a backup before handing them access… so you can roll back if necessary. Even if they’re not malicious, they are humans who can make mistakes. So this will save you from any accidental mistakes as well. Of course, if you need to roll back, your original problem will still be unresolved.
2) Install an activity monitor plugin that will monitor and log (or even email) you everything the support staff may do on your site. But a bad actor will likely check and remove such a plugin.
3) If you’re not running a WordPress security plugin, install one and run it to get a baseline security posture of your site. Then after the work is done, run it again to see if there are any changes, security-wise.
Good luck!
