there are goods and bads for that
but some suggestions form my view

I think that instead of FTP access you can allow to upload vis adminCP in folders like avatar, ranks etc
Some preinstalled mods will do the trick and users will not ask for more

But If uploading is allowed through adminCP it may overload MYSQl with too much queries
Also if someone uploads infected files then its difficult to manage it again

My personal opinion FTP shud me not allowed