1. Yes, future maintenance is their responsibility. Or we can do that for an hourly charge.
2. I remove all non-essential menus from the wordpress admin panel and they can only see the ones relevant to them. They do have access to those areas, just that they cannot see the menus.