Assuming you give them access to the folder containing your whole site (which is what I think you’re saying needs updating), once they have access in there, they can, in theory, delete every single file or folder in there. If you are thinking of giving them access to a lower level folder (part of your site), then they could do the same within that folder, but nothing at a higher level of the file structure. That said, the likelyhood of them doing that, or at least deliberately, is pretty low.
What I can imagine them wanting, is to take a copy of the whole of your existing site structure, so that they replicate that on their development server to work on, so they can make it responsive, conduct testing, ensure things haven’t been broken in the process and so on.