Install by non-ecrypted ftp? really?

I purchased a Magento 2 theme and my install didn’t look right. I thought maybe it’s me, I’m just getting up to speed with M2. So I purchase the install for $70. The technician said he needed ftp and phpmysql, and that he would be completely overwriting my site. Well, sorry, but I don’t enable ftp nor install anything not completely necessary to run the site. Login is by ssh private key, and that is that. In this case, it was a pristine install, but what if it was an upgrade to an existing site? The instructions to install came with it, I presumed that is what would be followed. And there is no avenue to provide feedback. thanks for nothing.