Hello. I know, that you cannot allow FTP Access, but you can allow uploading plugins/mods, BUT the jar file will be scanned with virustotal api or something. If it contains any viruses, the file will be rejected.
No, ftp cant be offered because of security risk, in ftp you can do all you want in server for example download a virus and plugin that are not suitable like enjin buycraft etc and make your server 24/7 add fake players , and it will not offered! It much complicated than you think