It sounds like an excuse where they don't have the expertise on how to manage and/or secure them.
There are always risks when you put things up on the Internet. Even SSH has security issues if things aren't properly addressed. As long as you (or your hosting provider) take the necessary security precautions and keep things up-to-date, you probably won't have an issue.
If you want a control panel, it's probably best if you move on to another host that offers it.