Plesk is pretty good about setting up the proper security settings between domain accounts and subdomains, including FTP access.
Many sites do grant FTP access to 3rd parties that they work with because there's not as much risk with FTP, providing that root access isn't permitted, which can be set in Plesk (as it seems you already have done).
I would suggest making sure the FTP account username is specific to them so you can track login's in the server logs. Also be sure to use a password which is not close to any others that you might use elsewhere.
Other than that, I would monitor the FTP directory contents to make sure they, or someone else who potentially has their username/password, isn't serving anything unwanted from your FTP site. You can easily monitor the bandwidth to the domain account via Plesk to make sure this isn't being abused, and assign maximum bandwidth allowances and maximum FTP account sizes too.
Plesk also automatically manages things like abusive IP's that attempt to login repetitively (including FTP logins), so you won't have to be concerned about brute force attacks should their login information get exposed or your business relationship end; you'll only need to change the username and password to something else secure (or just deleted the FTP account).
In short, providing that you set FTP and bandwidth limits in Plesk, and monitor the FTP directory contents, you should be safe granting FTP access to a 3rd party you do business with.
